Should the Record of Categories of Processing Activities Be Maintained Separately for Each Data Controller, or Is a Single Consolidated Record Permissible?
ANSWER
The obligation to maintain a record of categories of processing activities arises from Article 30(2) GDPR. As a general rule, the provision indicates that a record of all processing activities carried out on behalf of the controller must be maintained. This provision may therefore be interpreted both as requiring the processor to maintain separate records of categories of processing activities on behalf of each data controller, and as permitting a single record to be maintained. In the latter case, the categories of processing activities attributable to each data controller must be distinguished within the single record. Both approaches are permissible and correct.
