How should Art. 30(4) be understood – must the record of processing activities be made available only upon request of the supervisory authority (UODO)?

ANSWER

That provision creates an obligation to submit the register to the supervisory authority if the authority requests it. At the same time, the controller is not required on its own initiative, by way of proactive action, to submit the register to the supervisory authority without a request from it.

Since we are speaking of making the register available, please bear in mind that the purpose of maintaining the register is to systematise the personal data processing operations performed, which determines its strictly internal and organisational character. It is therefore not public or publicly accessible, should not be published on the controller's website, or made available to interested individuals. It is worth remembering that it contains a number of key pieces of information, including a list of security measures applied, which should remain confidential.