Record of processing activities in Notion: what columns Article 30 requires
29 October 2026 · Sources checked on 29 October 2026.
The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) has applied since 25 May 2018 (Article 99(2)), and its Article 30 requires a record of processing activities. It says what information the record contains, not in what format: paragraph 3 only requires it to be in writing, "including in electronic form". A Notion database with one row per activity and one column per item is one way of organising it. This article summarises what the official text says and suggests those columns; it does not interpret and it does not constitute legal advice.
Who keeps it
- **The controller** (whoever decides why and how the data are processed) maintains a record of processing activities under its responsibility (paragraph 1).
- **The processor** (whoever processes data on behalf of someone else, such as a payroll bureau running its clients' payroll) maintains a record of all categories of processing activities carried out on behalf of each controller (paragraph 2).
- Both make the record available to the supervisory authority on request (paragraph 4). In Spain, Organic Law 3/2018 on data protection (LOPDGDD) adds in its Article 31(1) that the record may be organised around structured sets of data, that it must specify the activities according to their purposes and that, where there is a data protection officer, any addition, change or removal is communicated to them.
The columns of the controller's record (Article 30(1))
One row is one processing activity ("Payroll", "Customers", "Recruitment", "CCTV"). The letters are those of paragraph 1; the column name and the Notion property type are a suggestion, not something the GDPR says.
| Point | What Article 30(1) requires | Column | Notion type |
|---|---|---|---|
| — | (each processing activity) | Processing activity | Title |
| (a) | The name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer | Controller and contacts | Relation to a one-row "Organisation" database (they are the same for almost every activity); "Joint controller", text, where there is one |
| (b) | The purposes of the processing | Purposes | Text |
| (c) | A description of the categories of data subjects | Categories of data subjects | Multi-select (employees, customers, candidates…) |
| (c) | A description of the categories of personal data | Categories of data | Multi-select (identification, financial…) |
| (d) | The categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organisations | Recipients | Multi-select (tax authority, bank, payroll bureau…) |
| (e) | Where applicable, transfers to a third country or an international organisation, with its identification and, for transfers under the second subparagraph of Article 49(1), the documentation of suitable safeguards | International transfers | Checkbox, plus a text with the country or organisation and the documentation |
| (f) | Where possible, the envisaged time limits for erasure of the different categories of data | Erasure time limits | Text |
| (g) | Where possible, a general description of the technical and organisational security measures referred to in Article 32(1) | Security measures | Relation to a "Measures" database (encryption, backups, access control…), so they are not rewritten on every row |
Two details of the text: point (c) asks for **two** descriptions (of data subjects and of data), hence two columns; and points (f) and (g) say "where possible", while the others carry no such proviso.
Columns that Article 30 does not require but that help keep it up to date: the date each row was last reviewed and who looks after it inside the company. The legal basis of the processing (Article 6 GDPR) is not in Article 30(1) either; in Spain, the LOPDGDD does require it in the public inventory that the bodies listed in its Article 77(1), which are public-sector bodies, must publish (Article 31(2)).
The columns of the processor's record (Article 30(2))
If the company processes data on behalf of clients, that record is a separate one, with fewer items. One row is one category of processing carried out for a controller:
| Point | What Article 30(2) requires | Column | Notion type |
|---|---|---|---|
| (a) | The name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's representative, and the data protection officer | Controller (client) | Relation to a "Clients" database; the processor's own details, in the "Organisation" database |
| (b) | The categories of processing carried out on behalf of each controller | Category of processing | Title |
| (c) | Where applicable, transfers to a third country or an international organisation, with its identification and, for transfers under the second subparagraph of Article 49(1), the documentation of suitable safeguards | International transfers | Checkbox, plus text |
| (d) | Where possible, a general description of the technical and organisational security measures referred to in Article 32(1) | Security measures | Relation to the "Measures" database |
When the record is not required: paragraph 5
Article 30(5) says that the obligations in paragraphs 1 and 2 "shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10."
These are three cases joined by "or". The Article 29 Working Party (the independent European advisory body set up by Directive 95/46/EC, before the GDPR) explained it in a position paper on Article 30(5): any one of the three is enough to require the record; only the processing that falls within one of them needs to be recorded; and, as an example, a small organisation is likely to process its employees' data regularly, so that processing cannot be considered "occasional". For the Working Party, processing is only occasional if it is not carried out regularly and occurs outside the regular course of business.
In the Notion database, a checkbox "Falls under Article 30(5)" or a select with the case ("not occasional", "risk", "special categories or criminal data") records why each activity is in the record.
The free tool from the Spanish authority (AEPD)
The Spanish Data Protection Agency (AEPD) offers Facilita RGPD, free of charge, for companies that process low-risk data (customers, suppliers, human resources). The documents it generates include the record of processing activities; it is not meant for high-risk processing, such as health data or large-scale processing, and the AEPD warns that obtaining the documents does not mean the obligations are automatically met. What it does and for whom, on its page (in Spanish): https://www.aepd.es/guias-y-herramientas/herramientas/facilita-rgpd
A Notion database does not replace that tool: it is another way of keeping the same information, useful if the company already works in Notion and wants to link the record to its suppliers, its measures or its systems.
If the company uses AI
An AI system that processes personal data (a CV filter, a chat with identified customers) is one more activity in the record. Reglario's AI Inventory template keeps the inventory the EU AI Act calls for and marks each system with "Processes personal data" and "Processes special categories of data", to cross-check it with this record: AI Inventory. It is not the Article 30 record.
Reglario is considering a Notion template for the record of processing activities, with these columns and the text of Article 30 linked in each one. It has no date. If you are interested, sign up for the email updates at the end of this page: we will write if it comes out.
Sources (opened on 29 October 2026)
- Regulation (EU) 2016/679 (GDPR) of 27 April 2016 (OJ L 119, 4 May 2016), the version given by EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679 — Articles 30, 32 and 99.
- Spanish Organic Law 3/2018 on the protection of personal data and digital rights (LOPDGDD), consolidated text in the BOE (last update published on 27 December 2025, in Spanish): https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 — Article 31.
- Article 29 Working Party, position paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR: https://ec.europa.eu/newsroom/article29/items/624045
- Spanish Data Protection Agency (AEPD), Facilita RGPD: https://www.aepd.es/guias-y-herramientas/herramientas/facilita-rgpd
Document organisation tool based on official texts; it does not constitute legal advice.