What it asks for. Controllers must keep a written record of processing activities under their responsibility, including the purposes, categories of individuals and data, recipients, international transfers, retention periods where possible and a general description of security measures. Processors keep a similar record of processing carried out for each controller. Records must be available to the supervisory authority on request. A limited exemption exists for organisations with fewer than 250 employees, but it does not apply in many common situations.
In practice. The record is maintained as a living inventory, owned by named people and updated when systems or purposes change. Good records link to lawful bases, DPIAs, retention rules and vendor contracts. Evidence includes the record itself, review dates and change history.
Common gaps. Records are often compiled for a project and then left to go stale. Shadow IT and new SaaS tools are frequently absent.