Your GDPR register is up to date. Does practice match it?

Yesterday's accurate record can miss today's changes

A team opens its register before a review. The record names two recipients and a retention period. Since the last update, a department has changed providers, added an export and granted new permissions. The document is not useless: it is a starting point for identifying those changes.

The practical question is whether recorded facts still match operations. Do not dismiss the DPO's documentation work, or mistake a complete document for verification of every practice. Documentation and operational review are strongest when connected.

What a processing register actually provides

GDPR Article 30 specifies records of processing activities, including purposes, categories of information and people, recipients and other details depending on the organisation's role. France's CNIL describes the register as a documentation and management tool that should reflect actual processing.

Article 30(5) provides a limited derogation for enterprises and organisations with fewer than 250 employees. Records remain required for processing likely to pose a risk to individuals' rights and freedoms, processing that is not occasional, or processing of Article 9 special-category data or Article 10 criminal-conviction and offence data. Headcount alone therefore does not establish a general exemption.

It is a living resource that helps identify unresolved questions. Missing information should remain visible and be assigned for verification. Filling a field with reassuring but unverified language does not improve knowledge of the processing activity.

Accountability and security extend beyond the inventory

Article 5(2) requires controllers to be able to demonstrate compliance with the principles. Article 24 requires appropriate measures and their review and update where necessary. Article 32 addresses risk-appropriate security, including, as appropriate, regular testing and assessment of safeguards.

This does not require every organisation to buy the same software or prepare an identical dossier. Useful evidence depends on processing, risks and responsibilities. Distinguish what is planned, what has been implemented and what has been checked.

Six practical comparisons to make

Select a priority processing activity and compare its record with available evidence. These review prompts are not an exhaustive compliance checklist.

• Declared purpose: does it still match the department's actual use?
• Recorded data: are there additional exports or copies?
• Listed recipients: are providers and authorised people accurately identified?
• Stated retention: how are deletion and archiving actually applied?
• Described security: what checks, tests or reviews support its assessment?
• Identified gaps: who owns the next action, deadline and follow-up verification?

Turn disconnected documents into a usable case file

When evaluating a solution such as NELSPACE, start with a processing activity you know. Ask how the case facts, available documents, decisions and open issues can be connected. Check that limitations and missing information remain visible.

The practical aim is clearer cooperation between operational teams, the DPO and technical staff. An organised file supports review; it cannot replace the required measures or contextual assessment. A dashboard colour alone is not regulatory certification.