French GDPR Register of Processing Activities (Art. 30)

Yes. The Article 30(5) exemption for sub-250-employee organisations is very narrow. It disappears as soon as processing is non-occasional (payroll, customer management, HR), poses a risk to individuals' rights and freedoms, or involves special-category data under Article 9 (health, biometrics, political opinions, religious or philosophical beliefs, trade-union membership) or data on criminal convictions under Article 10. In practice, almost every TPE and PME must maintain a register covering at least their routine processing activities.

For each processing activity you must record: the name and contact details of the data controller (and DPO if one is appointed), the purposes of processing, the categories of data subjects and personal data involved, the categories of recipients, any transfers outside the EU, planned retention periods, and a general description of technical and organisational security measures. Processors (sous-traitants - service providers acting on a client's behalf) must keep a separate register of all processing carried out for each client under Article 30(2).

Failure to comply with Article 30 falls under the Article 83(4) sanction tier: an administrative fine of up to 10 million euros or 2% of total worldwide annual turnover for the preceding financial year, whichever is higher. The CNIL regularly checks register compliance and it is typically the first document requested during an inspection - its absence immediately signals non-compliance and can accelerate enforcement action.

The data controller (responsable de traitement - the entity that determines the purposes of processing) records activities carried out under its own authority under Article 30(1). A processor (sous-traitant - a service provider such as a payroll bureau, SaaS vendor or hosting provider) keeps a separate register of processing categories performed for each client under Article 30(2). The same organisation can hold both roles simultaneously and must maintain both register sections separately.

Yes. The CNIL publishes a downloadable spreadsheet template for organisations whose processing activities are limited in number and low in risk, covering all mandatory Article 30 fields. For more complex or sensitive processing the template must be supplemented, and a data-protection impact assessment (AIPD - analyse d'impact relative à la protection des données) may be required. The template is available on the CNIL's dedicated register page at cnil.fr.

No. The register is an internal compliance management document; it is not filed with or proactively sent to the CNIL. However, under Article 30(4) it must be kept up to date and made available immediately upon request during an inspection. It must be maintained in writing, which includes electronic format such as a spreadsheet or dedicated compliance software.