Records of processing review: stages and deadlines
A records of processing review moves through four stages: scoping, data collection, validation and sign-off. A full-scope review usually takes four to eight weeks, depending on the number of business units involved. The point of no return falls at sign-off: once management approves the updated register, any gap becomes a known and documented fact rather than an oversight.
What changes once the review starts
Before the review, gaps in the register are unrecognised risk. Nobody has confirmed which processing activities exist, on what basis, or for how long data is kept. Once the review starts, that changes. Interviews and data sheets create a paper trail. If a gap surfaces during scoping or collection, it can still be closed quietly, as part of ordinary housekeeping.
After sign-off, the position is different. A gap that survives an approved review looks like a decision, not an accident. This is why the sign-off stage deserves more attention than organisations usually give it. Rushing sign-off to hit an internal deadline can turn a manageable gap into a documented failure to act.
Stages and typical duration
The table below sets out the four stages most organisations follow, with typical duration for a mid-sized business running the review across three to six business units.
| Stage | What happens | Typical duration | Output |
|---|---|---|---|
| Scoping | List of processing activities agreed with each business unit | 3–5 working days | Draft inventory |
| Data collection | Purpose, legal basis, retention, recipients and transfers confirmed for each entry | 2–4 weeks | Completed data sheets |
| Validation | Legal and security teams check entries against contracts and actual system configuration | 1–2 weeks | Reviewed register |
| Sign-off | Management or the data protection officer approves the updated register | 1 week | Approved register, version dated |
Organisations with more than six business units, or with processing that crosses several jurisdictions, should expect the collection and validation stages to run longer. Parallel interviewing across units shortens the timeline more reliably than adding people to a single interview track.
What to do
- Assign one named owner per business unit to confirm processing activities under their control.
- Collect existing data flow diagrams, vendor lists and retention schedules before scheduling interviews.
- Run structured interviews with each unit and record answers directly into the register template.
- Have the legal team check each entry against contracts and actual system configuration, not against what the policy says should happen.
- Circulate the draft register for comment with a fixed deadline, not an open-ended review window.
- Obtain sign-off from the data protection officer, or the person holding that function, before closing the cycle.
Who decides and by when
Internally, sign-off rests with the data protection officer or, where no such role exists, with the senior manager responsible for data protection. There is no external clock running on the review itself: it is an internal exercise, and the organisation sets its own timetable.
The external forum only appears if a supervisory authority requests the register during an inquiry or an investigation. At that point, the authority sets the response deadline in its request, and the deadline is short by design. A register that is already current at that moment saves the response time that would otherwise go into scrambling to reconstruct it.
Branches
If the review shows that rights over a dataset were acquired through an assignment rather than built in-house, the timing of that transfer runs on its own separate clock: see When an assignment breaks the chain of title: the.
If a supplier or a competitor challenges the same data asset in parallel litigation, an injunction application can move faster than the internal review timetable: see When an injunction application is served: the deadline that.
If a customer treats the review as leverage and demands unlimited liability in the processing agreement under discussion, that negotiation runs on a different timetable altogether: see When a customer demands unlimited liability: when the other.
If the organisation also issues tokens and the review touches investor-facing disclosures, the offering document has its own update cycle, distinct from the register: see Update of the offering document step by step in.
What this page does not cover
This page describes the review mechanics: stages, typical duration, who signs off and what happens if a request arrives afterwards. It does not set out what must appear in each register entry, how retention periods should be calculated, or how a supervisory authority assesses a shortfall once it finds one. Those questions need a different starting point than a procedural walkthrough.
Related publications
Where the review touches transfers of data outside the organisation's home jurisdiction, it usually runs alongside a separate check: Transfer mechanism assessment.
Verified
Reviewed and current as of March 2025. This page sets out internal procedure only, based on how records of processing reviews are typically structured and run; it does not reference a specific statutory provision.
FAQ
How long does records of processing review take in practice?
Four to eight weeks for a mid-sized organisation with three to six business units. Larger or multi-jurisdiction organisations should plan for longer collection and validation stages.
Which documents are needed to start?
Existing data flow diagrams, vendor and sub-processor lists, retention schedules and any prior version of the register. Scoping without these documents takes longer, because interviews then have to reconstruct information that already exists somewhere else.
What happens if the other side does not respond?
If a business unit does not respond to a data collection request, the owner should escalate to a fixed internal deadline rather than let the stage drift. An unresponsive unit does not pause the review; it becomes an open item flagged at validation and, if unresolved, at sign-off.