Data protection in practice: records of processing, processor agreements and data breaches
What to record, what to agree with suppliers and what to do in the first days after a data breach.
In this topic: IT and data 18
Most of the day-to-day work in data protection comes down to three documents: a record of the personal data you process and why, a written agreement with every supplier that handles that data for you, and a log of the incidents that went wrong. Customers ask for them in supplier questionnaires, and after a breach they show whether anyone was in control.
This guide uses the EU's General Data Protection Regulation (GDPR) as the reference point. It applies to organisations established in the EU, and also to organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour there (source: EUR-Lex, April 2016). The last section compares the rules in five other jurisdictions.
Under the GDPR, nearly every employer needs a record of processing: the exemption for organisations with fewer than 250 employees does not cover regular processing such as payroll (source: EUR-Lex, April 2016). Every supplier that processes personal data for you needs a written agreement with set contents. A breach that poses a risk goes to the data protection regulator within 72 hours, and to the people affected when the risk is high (source: EUR-Lex, April 2016).
- Records
- Processors
- Breaches
- Transfers
Controller and processor: who decides and who carries out
The GDPR gives each organisation a role per processing activity. Your obligations follow from that role far more than from your size.
Personal data is any information about a person who can be identified, directly or indirectly, for example by a name, an identification number, location data or an online identifier (source: EUR-Lex, April 2016). Processing special categoriesSpecial categoriesPersonal data that the GDPR protects more strictly, such as data about health, ethnic origin, religion, trade union membership, biometrics, sex life or sexual orientation. of data, such as health data, is prohibited unless an exception applies (source: EUR-Lex, April 2016).
The controller decides why and how personal data is processed; the processor processes it on the controller's behalf (source: EUR-Lex, April 2016). Take an accounting firm with forty staff. For its own payroll and client files it is the controller, and its payroll provider and cloud storage are processors. When it runs payroll for a client, it usually acts as that client's processor. A processor may in turn use a sub-processorSub-processorA supplier that your processor engages for part of the work, such as the cloud host behind a payroll service., such as a cloud host.
Who needs a record of processing activities
Controllers and processors must keep a written record of their processing, which may be electronic, and show it to the supervisory authoritySupervisory authorityThe independent public authority that enforces data protection law, usually the national data protection authority. on request (source: EUR-Lex, April 2016).
The exemption for organisations with fewer than 250 employees is narrow: it only applies when the processing is unlikely to result in a risk to people, is occasional, and involves no special categories or criminal-conviction data (source: EUR-Lex, April 2016). Payroll runs every month, so it is not occasional. According to the European Data Protection Board, smaller organisations need not list purely occasional activities, such as a one-off event, while recruitment, payroll and prospect lists belong in the record (source: EDPB, November 2026).
Keep one line per activity, such as payroll or customer orders. The GDPR asks for (source: EUR-Lex, April 2016):
- Who you are: contact details of the organisation and any data protection officer.
- Purposes: why you process the data.
- People and data: the categories of people and of personal data.
- Recipients: who receives the data, also abroad.
- Transfers: transfers outside the EEA and, for some, the safeguards used.
- Retention: where possible, when each category of data will be deleted.
- Security: where possible, a general description of your measures.
Add the lawful basis, such as a contract, a legal obligation, consent or legitimate interests. The record does not require it, but most questions about an activity start there.
The EU is working on lighter record-keeping obligations for SMEs and small mid-caps, including under the GDPR (source: Council of the EU, June 2026). Until a change is adopted and in force, the current rule applies.
What a processor agreement must contain
Use only processors that give sufficient guarantees, and put the arrangement in a written contract, which may be electronic (source: EUR-Lex, April 2016).
Typical processors are a payroll provider, an IT partner, a cloud service and a newsletter service. A party that decides for itself what it does with the data, such as a tax authority, is a controller in its own right and needs no processor agreement.
Besides the subject, duration, nature and purpose of the processing, the types of data and the people concerned, the contract must cover eight points (source: EUR-Lex, April 2016):
- Instructions: processing only on your documented instructions, also for transfers abroad.
- Confidentiality: everyone with access is bound to confidentiality.
- Security: the measures the GDPR requires.
- Sub-processors: only with your prior written authorisation, and with the same obligations passed on.
- Rights requests: help when people ask for access, correction or deletion.
- Breaches and assessments: help with security, breach notification and impact assessments.
- End of contract: deletion or return of all personal data, at your choice.
- Audits: information to show compliance, and room for audits.
Two points deserve more than the legal minimum. The law only says that a processor reports a breach to you without undue delay (source: EUR-Lex, April 2016); agree a deadline in hours, so that you keep time for your own notification. And if a sub-processor fails, your processor remains fully liable to you (source: EUR-Lex, April 2016), so agree who bears the costs.
Data breaches: notify, inform and log
A data breach is a breach of security that leads to personal data being destroyed, lost, altered, disclosed or accessed without authorisation, by accident or on purpose (source: EUR-Lex, April 2016). An email to the wrong person counts, and so does a stolen laptop.
The clock starts when you become aware of the breach. Notify the supervisory authority within 72 hours unless the breach is unlikely to result in a risk to people; a late notification must explain the delay, and you may send the details in phases (source: EUR-Lex, April 2016). The deadline counts hours, not working days, so a breach found on Friday afternoon must be reported by Monday afternoon.
When the risk to people is high, inform them too, without undue delay, unless for example the data was encrypted and unreadable to others (source: EUR-Lex, April 2016).
Log every breach, including those you do not report: the facts, the effects and the remedial action (source: EUR-Lex, April 2016). The log is how you show later why you decided not to notify. For an attack on your systems, see ransomware response.
In its negotiating mandate on the EU's Digital Omnibus, the Council supports dropping notification to the authority for breaches that are not likely to result in a high risk (source: Council of the EU, October 2026). That is a negotiating position, not law: until a change applies, notify as described here.
Sending personal data outside the EEA
Personal data may leave the EEAEEAThe European Economic Area: the EU countries plus Iceland, Liechtenstein and Norway. only on a ground the GDPR provides (source: EUR-Lex, April 2016). For most businesses that means an adequacy decision or standard contractual clauses.
An adequacy decision is the European Commission's finding that a country protects personal data adequately; data can then flow there without further safeguards (source: European Commission, November 2026). As of November 2026 the list includes, among others, the United Kingdom, Switzerland, Japan, the Republic of Korea, Canada for commercial organisations, and Brazil since January 2026 (source: European Commission, November 2026). For the United States, it covers only companies that participate in the EU-US Data Privacy Framework, or DPF (source: European Commission, November 2026).
Without an adequacy decision you need an appropriate safeguard, usually the standard contractual clausesStandard contractual clausesModel contract terms adopted by the European Commission that sender and recipient sign to protect personal data sent outside the EEA. adopted by the European Commission, signed with the recipient (source: EUR-Lex, April 2016). Record every transfer and its basis in your record of processing.
Data protection laws elsewhere: a short comparison
Many privacy laws outside the EU use similar building blocks, with other thresholds, deadlines and terms. Five examples as of November 2026; check the rules wherever you have staff or customers.
| Where | Main law and regulator | Breach notification | Worth knowing |
|---|---|---|---|
| United Kingdom | UK GDPR and Data Protection Act 2018; the ICO | To the ICO within 72 hours where required (source: ICO, November 2026) | The Data (Use and Access) Act 2025 amends these laws in stages and requires organisations to handle complaints from individuals (source: UK government, November 2026) |
| California, United States | California Consumer Privacy Act (CCPA); California Privacy Protection Agency | Under the state's breach law, notify affected residents, and send the Attorney General a sample notice when more than 500 are notified (source: California Attorney General, November 2019) | Applies to for-profit businesses above revenue or data-volume thresholds, and has covered employee and business-contact data since 2023 (source: California Attorney General, August 2026) |
| Canada (federal) | PIPEDA; Office of the Privacy Commissioner | Report breaches with a real risk of significant harm to the Commissioner, and notify the people affected, as soon as feasible (source: Privacy Commissioner of Canada, August 2025) | Keep records of all breaches for two years (source: Privacy Commissioner of Canada, August 2025) |
| Brazil | LGPD; the ANPD | Tell the ANPD and the people affected within three working days when an incident may cause relevant risk or damage (source: ANPD, August 2026) | The EU and Brazil adopted mutual adequacy decisions in January 2026 (source: European Commission, November 2026) |
| Australia | Privacy Act 1988; the OAIC | Notify the people affected and the OAIC when a breach is likely to result in serious harm (source: OAIC, March 2023) | Check whether the Act covers you |
Where several laws apply, the shortest deadline sets the pace of your breach procedure. For customer questions about your data handling, see security questionnaires; more guides are in IT and data.
How well is data protection organised?
Eight statements from this guide. Answer them for your organisation and see where to start.
- 1We know which of our suppliers are processors and which are controllers in their own right.
- 2We keep a written record of our processing, including payroll, customers and recruitment.
- 3Someone owns the record and updates it when a new system or supplier arrives.
- 4Every processor has signed an agreement with the required points.
- 5Staff know where to report a lost laptop or a misdirected email, the same day.
- 6We log every breach, including the ones we decide not to report.
- 7We know which suppliers store or receive personal data outside the EEA, and on what basis.
- 8We know the privacy and breach rules of every country where we have staff or customers.
Related guides
Example record of processing, processor agreement checklist and breach log
Below you will find an example record of processing for a wholesaler with sixty staff, a checklist for reviewing a processor agreement, and a breach log outline with a fictional example.
Frequently asked questions
Do we need a processor agreement with Microsoft, Google or another cloud provider?
Is an email sent to the wrong person a data breach?
How long may we keep personal data?
Do we need a data protection officer?
- EUR-Lex: General Data Protection Regulation (April 2016)
- EDPB: Data protection guide for SMEs, be compliant (November 2026)
- European Commission: Adequacy decisions (November 2026)
- Council of the EU: Digital omnibus, mandate for negotiations with the European Parliament (October 2026)
- California Attorney General: California Consumer Privacy Act (August 2026)
- Office of the Privacy Commissioner of Canada: Mandatory reporting of breaches of security safeguards (August 2025)