A register row is fine for most processing, but a complex or higher risk activity deserves a full description. This form gives one activity the space it needs, including any AI use and automated decisions.

Effective Form Templates

This form template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Form number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested form templates. No junk, jargon or unnecessary content. Simple and usable form templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on records of processing:

• Data Protection and UK GDPR
• Personnel Records and Data Protection
• ISO 42001 Annex A.9 - Use of AI Systems
• Legal and Compliance knowledge base

Logo Update Service

Download this form template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This form is also included in the GDPR / Data Protection Toolkit and the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like hands-on help documenting your processing activities and RoPA, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Record of Processing Form Template

A record of processing form for describing a single processing activity in full. It sets out the activity, who is responsible and whether it is carried out as a processor for someone else, then works through the data and processing, the purpose and lawful basis, transfers and sharing, protection and security, and the use of AI and automated decisions, with an overview table matching the personal data register.

What's Included in this Form

• Overview of the Processing Activity - processing activity, responsibility, acting as processor for, completed by and date reviewed
• 1 - Description of the Data and Processing Activity
• 2 - Purpose and Lawful basis for the Processing
• 3 - Details of any Transfer or Sharing of the Data - including AI providers and international transfers
• 4 - Overview of Data Protection and Security
• 5 - Use of AI and Automated Decisions
• Overview of the Data - data category, description and who it is about, sharing, where held and protection, lawful basis and retention

Sample Data Version for Subscribers

A completed example based on recruitment is available with an alphaZ subscription.

Which Record Do I Need?

Use this form alongside a register for activities that need more detail. The register itself can be the F-IMS24 Personal Data Register (by data category), the F-IMS30 Record of Processing Activities Register (by processing activity) or the ER21 Personal Data Register in Excel.

Included in the GDPR / Data Protection Toolkit

This form is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download, and is also included in the ISO 27001 and ISO 22301 toolkits.

Works with the Data Protection Impact Assessment

Where the activity looks high risk, the F-Q97 Data Protection Impact Assessment assesses the risk to individuals and the controls needed before the processing goes ahead.

Using the Form

Complete one form for each activity that needs more than a register row, such as recruitment, CCTV, customer profiling or an AI system used with personal data. Keep the overview table in line with your register so the two do not disagree, and review the form when the activity changes.

Acting as a Processor

Where your organisation processes personal data on behalf of a client, the form records who you act for, so processor activities are kept separate from those where you are the controller.

Related Documents

Other documents in the GDPR / Data Protection Toolkit that work alongside this one:

• F-IMS24 Personal Data Register
• F-Q97 Data Protection Impact Assessment
• F-Q21 Data Transfer and Processing Agreement
• P-26 Privacy Policy

Why a Full Description Helps

Writing an activity out in full makes gaps easier to see - an unclear lawful basis, a supplier with no agreement, or an AI tool nobody has approved - before they become a problem.