When records of processing are incomplete: what to do first
Treat an incomplete processing record as an operational gap, not a paperwork task. Freeze any new processing that touches the missing entry, assign one owner to rebuild it from the source system, and date-stamp the correction. The gap itself rarely causes a penalty. Leaving it unaddressed after you find it does.
Why this matters legally
The duty to keep processing activities documented sits in the data protection framework that applies to your organisation across Lithuania and Estonia. Where the same processing also touches network and information systems in scope of Directive (EU) 2022/2555 (NIS2), the documentation duties overlap: NIS2 requires organisations to keep records of the security measures applied to those systems, and a gap in one record often points to a gap in the other. Where the missing entry concerns a high-risk AI system, Regulation (EU) 2024/1689 (AI Act) adds its own logging and record-keeping duty, though that duty only becomes enforceable from 2 August 2026, a date confirmed at the latest registry review. None of these obligations excuse an incomplete entry retroactively. They only tell you which authority is likely to ask about it first.
What changes in practice
An incomplete record does not stop processing on its own. It does remove your defence the moment a regulator, an auditor, or a counterparty asks to see it during a live check. A register that is thin in one place invites scrutiny of the whole document, not just the missing line. Contractual counterparties run due diligence against the same register before signing, so a gap discovered mid-negotiation slows a deal rather than a supervisory case. The practical cost of an incomplete entry is almost always timing: it appears at the worst moment, not the convenient one.
What to do, step by step
Work the fix in a fixed order. Skipping the sequence to save time usually recreates the same gap under a different heading.
| Step | Who does it | Why it matters |
|---|---|---|
| Name one owner for the register | Data protection function or delegated manager | A shared file with no named owner regenerates the same gap |
| Pull the missing description from the system that generates the data | System or process owner | Entries rebuilt from memory tend to repeat the original error |
| Check the legal basis field before writing anything else | Data protection function | A wrong basis inside a fix creates a second, harder-to-spot error |
| Date-stamp the correction and keep the earlier version | Register owner | A corrected entry with no history looks identical to one that was always complete |
| Notify the data protection function once the entry closes | Register owner, in writing | Creates the internal evidence of when the gap was found and fixed |
| Mirror the correction in NIS2 documentation, if the system falls within its scope | Security or compliance lead | Two parallel gaps in the same system are treated as one weaker case, not two smaller ones |
Who decides, and how
Your own data protection function decides first whether the gap is material enough to escalate, based on how long the entry stayed incomplete and what it covered. Only the national supervisory authority decides whether an incomplete record amounts to an infringement, and it decides on the evidence you hold at the moment it asks, not on the evidence you could have held earlier. There is no fixed internal clock running automatically from the date you find the gap. The clock that matters starts on the date the authority makes its request, once an inquiry opens, and it runs against whatever record exists on that day.
If your situation differs
If the incomplete entry sits inside a licensing schedule that defines what a licensee may process, check the licence wording before touching the register, because sloppy drafting there compounds the gap (see When exclusive and sole are used interchangeably and the).
If the entry documents research data tied to a pending patent filing, coordinate the correction with whoever manages the invention disclosure, because a duplicated inventor entry creates a separate problem of its own (see When the same invention is granted to someone else).
If the processing runs on a vendor's software under a support arrangement that has already lapsed, rebuild the entry from the current support terms rather than the original agreement (see When support ends but the licence continues explained).
What this page does not cover
This page does not set the specific deadline your case will face once a regulator opens an inquiry; that depends entirely on the wording of its request. It does not cover processing registers built around token issuance, where the operative question is usually a change of issuer jurisdiction rather than a gap in the register itself (see When the issuer changes jurisdiction step by step). It also does not replace advice on whether the underlying processing needed a legal basis in the first place; that is a separate assessment, not a register-formatting question.
How we verified this
This page reflects the sources checked at the latest registry review. Directive (EU) 2022/2555 (NIS2) and Regulation (EU) 2024/1689 (AI Act) are cited where their documentation duties genuinely overlap with an incomplete processing register. The AI Act's 2 August 2026 entry-into-force date is current as of that review. Where the obligation to maintain processing records itself is discussed, this page describes the mechanism rather than naming a specific national provision, because that provision has not yet been checked against this registry.
Related situations
If your gap involves a subprocessor added after the register was originally built, the fix runs through a slightly different sequence (see When a subprocessor is added mid-term in practice).
If a wider audit is already under way, our data protection team can help rebuild the register and align it with any parallel NIS2 or AI Act documentation. We give an initial reply on the same working day.
FAQ
What is the first step when records of processing are incomplete?
Name a single owner for the register and freeze new processing that touches the missing entry, before you write a single correction.
Which deadline is already running?
None runs automatically from the date of discovery. The deadline that matters starts once a supervisory authority makes a specific request, and it is measured against the record as it stands that day.
Who decides, and on what evidence?
Your data protection function decides whether to escalate internally. The supervisory authority decides on any infringement, based solely on the evidence the register shows at the moment it asks.