A register row is fine for most processing, but a complex or higher risk activity deserves a full description. This form gives one activity the space it needs, including any AI use and automated decisions.
This form template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Form number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested form templates. No junk, jargon or unnecessary content. Simple and usable form templates
developed over 25 years through practical use in the real world.
Further guidance on records of processing:
Download this form template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This form is also included in the GDPR / Data Protection Toolkit and the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help documenting your processing activities and RoPA, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Record of Processing Form Template
A record of processing form for describing a single processing activity in full. It sets out the activity, who is responsible and whether it is carried out as a processor for someone else, then works through the data and processing, the purpose and lawful basis, transfers and sharing, protection and security, and the use of AI and automated decisions, with an overview table matching the personal data register.
What's Included in this Form
- Overview of the Processing Activity - processing activity, responsibility, acting as processor for, completed by and date reviewed
- 1 - Description of the Data and Processing Activity
- 2 - Purpose and Lawful basis for the Processing
- 3 - Details of any Transfer or Sharing of the Data - including AI providers and international transfers
- 4 - Overview of Data Protection and Security
- 5 - Use of AI and Automated Decisions
- Overview of the Data - data category, description and who it is about, sharing, where held and protection, lawful basis and retention
Sample Data Version for Subscribers
A completed example based on recruitment is available with an alphaZ subscription.
Which Record Do I Need?
Use this form alongside a register for activities that need more detail. The register itself can be the F-IMS24 Personal Data Register (by data category), the F-IMS30 Record of Processing Activities Register (by processing activity) or the ER21 Personal Data Register in Excel.
Included in the GDPR / Data Protection Toolkit
This form is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download, and is also included in the ISO 27001 and ISO 22301 toolkits.
Works with the Data Protection Impact Assessment
Where the activity looks high risk, the F-Q97 Data Protection Impact Assessment assesses the risk to individuals and the controls needed before the processing goes ahead.
Using the Form
Complete one form for each activity that needs more than a register row, such as recruitment, CCTV, customer profiling or an AI system used with personal data. Keep the overview table in line with your register so the two do not disagree, and review the form when the activity changes.
Acting as a Processor
Where your organisation processes personal data on behalf of a client, the form records who you act for, so processor activities are kept separate from those where you are the controller.
Related Documents
Other documents in the GDPR / Data Protection Toolkit that work alongside this one:
Why a Full Description Helps
Writing an activity out in full makes gaps easier to see - an unclear lawful basis, a supplier with no agreement, or an AI tool nobody has approved - before they become a problem.
Would you rather we prepared it for you?
Our Personal Data Register and Privacy Notice Preparation service works through the personal data your organisation holds with you, including the AI tools in use, and prepares the register and privacy notice so they describe what actually happens to that data.
Personal Data Register and Privacy Notice Preparation