Records of processing review: documents to prepare
A records of processing review checks whether the register of processing activities still matches what the organisation actually does. Preparation means gathering current data flows, the prior version of the register, vendor lists, and access logs before the review starts. Missing documents extend the review; they do not shorten it.
Practical consequence
Gaps surface quickly once the review begins. A register that still lists a vendor no longer in use, or omits a data flow added last quarter, becomes visible to whoever conducts the check. The immediate effect is delay: the reviewer pauses, requests the missing item, and the file sits open until it arrives. Organisations that assemble the documents before the review starts avoid most of this delay.
There is also a point past which correction stops being informal. Once findings are recorded in writing, updating the register becomes a documented amendment rather than a quiet edit. After that point, every later change to the same entries needs its own record of what changed and why.
What to do
- Assign one internal owner responsible for the file for the duration of the review.
- Pull the current register of processing activities together with its previous version.
- List every vendor and sub-processor with an active contract touching personal data.
- Collect data flow diagrams, or draft one where none exists yet.
- Gather access logs covering the period under review.
- Flag any processing activity added or dropped since the register was last updated.
Who decides and timing
| Stage | Typical duration | Who acts |
|---|---|---|
| Document collection | 1–3 weeks | Internal owner |
| Initial review | 1–2 weeks | Reviewer or data protection function |
| Follow-up requests | Variable | Internal owner responds |
| Closing note | A few days | Reviewer records the outcome |
The decision on scope usually rests with whoever holds the data protection function inside the organisation, whether that is a dedicated officer or a delegated manager. That person decides which entries need correction and which can wait for the next scheduled update.
Forks
If the review overlaps with a licence deal that has just closed, the same access log often serves both files. A similar cross-check is set out in How post-closing integration IP licence what the decision maker looks at.
If a related file is moving on a separate track and the counterpart has already acted, the timing on this review may compress, a situation covered in When the other side moved first in this situation.
If a technology contract under review carries a benchmarking clause, the same vendor evidence often supports both exercises, as described in Benchmarking clause: what the decision maker looks at.
If the organisation is also preparing a token offering in parallel, the update cycle for that document follows a comparable logic, set out in Update of the offering document: documents to prepare.
Limit
This page does not decide whether a specific processing activity should exist, and it does not size the cost of correcting the register. Both depend on the number of records involved and the number of jurisdictions the organisation operates in. Where those questions arise, they need a separate assessment rather than an answer folded into this checklist.
Verified
This overview reflects current practice observed in file preparation up to November 2025. Supervisory guidance in this area is reviewed periodically, and the checklist is updated when that guidance changes materially.
FAQ
How long does records of processing review take in practice?
Typically two to five weeks in total, depending on how quickly the internal owner assembles the documents and how many follow-up requests the reviewer raises along the way.
Which documents are needed to start?
The current register, its previous version, an up-to-date vendor list, and any available data flow diagrams or access logs covering the period under review.
What happens if the other side does not respond?
If a vendor or sub-processor does not confirm its own data flows within the requested period, the internal owner records the outstanding item in the file and proceeds with the information available. The gap is flagged for follow-up rather than left unrecorded.
Related
A comparable preparation checklist applies before a Transfer mechanism assessment, where much of the same vendor and data flow documentation can be reused directly.
Questions about a specific register, vendor list, or an upcoming review can be sent directly; we look at the documents you already have before asking for more.