How to build a data processor register

To comply with the General Data Protection Regulation (GDPR), every controller must maintain a register of its processors. These records feed into several processes, for example the record of processing activities under Article 30, the drafting of privacy notices, and the preparation of data processing agreements when the company itself acts as a processor. This is not merely about housekeeping – accurate documentation is essential to demonstrate compliance with the accountability principle. Below we outline how to build a robust register.

Three steps to a robust data processor register

• Identify all processors: Start by mapping all external processors that handle personal data on your behalf – for example cloud service providers, payroll administrators or IT consultants. Intra-group companies may also be in scope where they process data for another group entity.
• Document per GDPR Article 30: For each processor, record the name, contact details, categories of processing carried out and, where applicable, information on transfers to third countries. The article 30 documentation must be in writing and kept up to date as part of your record of processing activities.
• Review contracts regularly: Under GDPR Article 28, a data processing agreement must be in place with each processor. Ensure these agreements meet the legal minimum – including processor instructions, security measures and the management of sub-processors – and that each processor contract remains current.

Many organisations find it challenging to keep the register current, especially where there are numerous vendors or rapid changes in the IT environment. Link the register’s update cycle to other internal processes – for example procurement of new systems, tenders or changes of external consultants. This helps ensure no external processors are missed and that the company can present an accurate list in the event of an audit by the Data Protection Agency, supporting inspection readiness.

It is also prudent to appoint a responsible person or function with a mandate to follow up on both the register and the agreements. That person can ensure that new processors are reviewed before onboarding and that legacy relationships are properly closed, including the erasure or return of personal data. A clear procedure reduces the risk of unclear allocation of responsibilities and strengthens the organisation’s ability to uphold the accountability principle under the GDPR. Morling Consulting can help you establish both routines and practical tools for a robust data processor register.

At Morling Consulting, our GDPR lawyers support small and medium-sized organisations across Europe in complying with the GDPR, including by creating processes to maintain registers of data processors.