Internal

Record of processing

your own little inventory

It is your own inventory of what you do with personal data. Where the law asks for one, you keep it internally and show it to the authority if it asks.

What matters

One line per activityCustomers, newsletter, job applications, payroll, site contact form. Each one gets a line.
Think beyond the websiteIt also covers your staff and your suppliers, so it is wider than your privacy policy.
A simple table worksA spreadsheet is fine to start: what, why, whose data, who receives it, where it goes, how long, how it is protected.
Ask your providersYour web agency, host and mail tool can tell you what they handle for you.
Keep it aliveUpdate it when you add a tool or a new activity, and note the date.

Which country asks for what

Each row leads to the rules of that country.

Country	Record of processing	Who it concerns
Afghanistan	No rule found
Alabama	No rule found	Alabama law requires no record of data uses, no risk assessment and no log of consumer requests.
Albania	Required	Any business or provider, unless it has fewer than 250 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Algeria	Required	Every business or provider that uses personal data.
Andorra	Required	Any business or provider, unless it has fewer than 50 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Angola	No rule found
Antigua and Barbuda	No rule found
Argentina	Required	Any private business whose database goes beyond purely personal use.
Aruba	No rule found
Australia	No rule found
Austria	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Azerbaijan	Required	Anyone who runs an information system holding personal data, with listed exceptions such as state secrets.
Bahamas	No rule found
Bahrain	In some cases	A business must keep a register of each use of data that must be notified to the authority. Check the exemptions for notification.
Bangladesh	Required	Every business must keep records of the personal data it handles for at least five years, once this part of the law takes effect.
Barbados	Required	Every business and provider that uses personal data. The text sets no size threshold.
Belgium	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Belize	No rule found	No law applies today. When the 2021 Act starts, every business and provider will have to keep this record.
Benin	In some cases	Businesses that record their uses of data internally instead of declaring them, or that are exempted through a data protection officer.
Bermuda	No rule found	No record of data uses is required. The business must adopt suitable measures and policies, and name a privacy officer.
Bolivia	No rule found
Bosnia and Herzegovina	Required	Any business or provider, unless it has fewer than 250 staff and its use of data is occasional, not high risk and without sensitive or criminal offence data.
Botswana	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Brazil	Required	Every business that uses personal data, and every provider working for it, whatever its size. Small Brazilian businesses may use a simplified form, unless their use of data is high risk or their revenue is above the legal limit.
British Virgin Islands	No rule found
Brunei	In some cases	There is no general register. Every business must have data protection policies and practices, and must carry out a risk assessment before relying on consent by notice or similar rules.
Bulgaria	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Burkina Faso	No rule found
Burundi	In some cases	Only large data users: more than 200 employees, public bodies and some health or legal data holders.
Cabo Verde	No rule found
Cambodia	No rule found
Cameroon	Required	Every business or provider that uses personal data.
Canada (federal)	Something similar	No record of data uses is required. Every business keeps a record of all security breaches of personal information, and writes down why it collects data.
Canada: Alberta	No rule found	No record of data uses is required. The business must have privacy policies and practices, and give written information about them on request.
Canada: British Columbia	No rule found	No record of data uses is required. The business must have privacy policies and practices, and give information about them on request.
Canada: Manitoba	Something similar	No record of data uses is required. Every business keeps a record of all security breaches of personal information, and writes down why it collects data.
Canada: New Brunswick	Something similar	No record of data uses is required. Every business keeps a record of all security breaches of personal information, and writes down why it collects data.
Canada: Newfoundland and Labrador	Something similar	No record of data uses is required. Every business keeps a record of all security breaches of personal information, and writes down why it collects data.
Canada: Nova Scotia	Something similar	No record of data uses is required. Every business keeps a record of all security breaches of personal information, and writes down why it collects data.
Canada: Ontario	Something similar	No record of data uses is required. Every business keeps a record of all security breaches of personal information, and writes down why it collects data.
Canada: Quebec	Something similar	No record of data uses is required. Every business keeps a register of privacy incidents, and does a privacy impact assessment for each information system project using personal information and before sending data outside Quebec.
Cayman Islands	No rule found
Central African Republic	Required	Every business that uses personal data.
Chad	In some cases	Only businesses exempted from the declaration through a data protection officer.
Chile	In some cases	From 1 December 2026, only a business that chooses to adopt a compliance programme must describe its uses of data. The law does not require this from other businesses.
China	In some cases	A business must assess and record its use of data before sharing data with a provider, sending it abroad, publishing it, using sensitive data or taking automated decisions. A site with outside analytics or advertising tools is usually concerned.
Colombia	Required	Every business that uses personal data, and every provider working for it. The detail expected depends on the size of the business and the risk.
Colorado	Something similar	No record of data uses is required. Above the law's thresholds, a business keeps a log of consumer requests for 24 months and a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Comoros	No rule found
Connecticut	Something similar	No record of data uses is required. Above the law's thresholds, a business needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Costa Rica	Required	Every business responsible for a database. Databases run to distribute, share or sell data must also be registered with the authority.
Croatia	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Cuba	Required	Every person or business that holds a personal data file or database.
Cyprus	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Czech Republic	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Côte d’Ivoire	In some cases	Only businesses that appoint a data protection correspondent, which spares them the declaration.
Delaware	Something similar	No record of data uses is required. A business with data on 100,000 consumers or more (50,000 from 1 January 2027) needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Democratic Republic of the Congo	Required	Any business or provider; small businesses and start-ups only if the use of data is regular, risky, sensitive or about criminal offences.
Denmark	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Djibouti	In some cases	Only journalists who want to skip the declaration, through a press data protection officer.
Dominican Republic	No rule found
Ecuador	Required	Every business must report its databases to the national register. A business with 100 or more workers must also keep an internal record, as must a smaller one with risky or regular use of data.
Egypt	Required	Every business or provider that uses personal data.
El Salvador	Required	Every business and provider that uses personal data, under the rules of the State Cybersecurity Agency.
Equatorial Guinea	No rule found
Estonia	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Eswatini	No rule found
Ethiopia	Required	Every business or provider that uses personal data.
European Union	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Faroe Islands	Required	Any business or provider, unless it has fewer than 250 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Fiji	No rule found
Finland	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Florida	Something similar	No record of data uses is required. Only a business with over USD 1 billion in yearly revenue, under the law's further conditions, needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
France	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
French Polynesia	Required	Most businesses must keep records of their uses of data, as in mainland France. The exemption below 250 staff rarely applies to a site, because it does not cover regular uses.
Gabon	Required	Any business or provider; with fewer than 10 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Georgia	Required	Every business and provider, with no size limit.
Germany	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Ghana	No rule found
Gibraltar	Required	Any business or provider, unless it has fewer than 250 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Greece	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Greenland	In some cases	A private business notifies the Danish data protection authority before using data, with exceptions such as ordinary staff data; sensitive data needs its permission.
Grenada	No rule found
Guatemala	No rule found
Guinea	In some cases	Only businesses that appoint a data protection correspondent.
Honduras	No rule found
Hong Kong	In some cases	There is no general register. A business that refuses a request to see or correct personal data must write down the reasons in a log book.
Hungary	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Iceland	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
India	In some cases	There is no general register. From 13 May 2027, every business must keep data and logs of its use of data for at least one year. Large businesses named by the government also need a yearly impact assessment and audit.
Indiana	Something similar	No record of data uses is required. Above the law's thresholds, a business needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Indonesia	Required	Every business must record all its uses of personal data, with no size threshold. Providers working for a business have the same duty.
Iowa	No rule found	Iowa law requires no record of data uses, no risk assessment and no log of consumer requests.
Iraq	No rule found
Ireland	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Isle of Man	Required	Any business or provider, unless it has fewer than 250 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Italy	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Jamaica	Required	Every business that uses personal data, unless a ministerial order exempts it.
Japan	In some cases	There is no general register. A business must keep a record each time it gives personal data to a third party or receives it from one, but not when it gives data to a provider working for it.
Jersey	Required	Any business or provider, unless it has fewer than 250 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Jordan	In some cases	A business that shares data with a recipient must keep records of that data, the purpose and the person's consent. The data protection council can also set a public register.
Kazakhstan	Required	Every business must approve a list of the personal data it needs and log certain actions on it. Large businesses must also notify the authority before they start.
Kentucky	Something similar	No record of data uses is required. Above the law's thresholds, a business needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Kenya	No rule found
Kiribati	In some cases	A business must keep a written record of its data breaches and of the steps it took to send data abroad. Local businesses of lesser importance have a two-year delay.
Kosovo	Required	Any business or provider, unless it has fewer than 250 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Kuwait	In some cases	Only providers licensed by CITRA, whatever their size. A site without a licence is outside the regulation.
Kyrgyzstan	Required	Every business that holds personal records must keep a log of its operations on them. An impact assessment is also needed in some cases, for example sensitive data on more than 1,000 people.
Latvia	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Lebanon	In some cases	A business must declare its use of data to the Ministry of Economy and Trade. Some uses are exempt, for example customer data or uses based on prior consent.
Lesotho	No rule found
Liberia	No rule found
Liechtenstein	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Lithuania	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Louisiana	No rule found	No record of data uses is required. From 1 January 2027, a business above the law's thresholds needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Luxembourg	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Macao	In some cases	A business must notify the Office for Personal Data Protection of its use of data, or get its authorisation, unless exempt. An exempt business must still give the same basic details to anyone who asks.
Madagascar	Required	Every business that uses personal data.
Malawi	Required	Every business or provider that uses personal data.
Malaysia	Required	Every business covered by the law must keep a record of applications, notices, requests and other information on the personal data it handles.
Maldives	No rule found
Mali	No rule found
Malta	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Marshall Islands	No rule found
Maryland	Something similar	No record of data uses is required. Above the law's thresholds, a business needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling, with one for each algorithm used.
Mauritania	No rule found
Mauritius	Required	Every business or provider that uses personal data.
Mexico	Required	Every private business that uses personal data.
Micronesia (Federated States of)	No rule found
Minnesota	Something similar	No record of data uses is required. Above the law's thresholds, a business keeps written privacy policies, an inventory of its data and a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Moldova	Required	Any business or provider, unless it has fewer than 250 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Monaco	Required	Any business or provider, unless it has fewer than 50 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Mongolia	In some cases	There is no general register in the English text read. A business must keep a record of what it did after a data breach.
Montana	Something similar	No record of data uses is required. Above the law's thresholds, a business needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Montenegro	Required	Anyone who sets up a collection of personal data; from 19 March 2027, any business or provider, unless it has fewer than 250 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Morocco	No rule found
Mozambique	No rule found
Myanmar	No rule found
Namibia	No rule found
Nauru	No rule found
Nebraska	Something similar	No record of data uses is required. A business that is not a small business under the federal definition needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Netherlands	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
New Caledonia	Required	Most businesses must keep records of their uses of data, as in mainland France. The exemption below 250 staff rarely applies to a site, because it does not cover regular uses.
New Hampshire	Something similar	No record of data uses is required. Above the law's thresholds, a business needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
New Jersey	Something similar	No record of data uses is required. Above the law's thresholds, a business needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
New Zealand	No rule found
Nicaragua	Required	Every holder of a personal data file, public or private.
Nigeria	Required	Every business or provider, with no size threshold; the semi-annual report that joins this record comes from the data protection officer of those that have one.
North Macedonia	Required	Any business or provider, unless it has fewer than 50 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Norway	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Oklahoma	No rule found	No record of data uses is required. From 1 January 2027, a business above the law's thresholds needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Oman	Required	Every business and every provider working for it must create a record of its uses of personal data.
Oregon	Something similar	No record of data uses is required. Above the law's thresholds, a business needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Pakistan	No rule found
Palau	No rule found
Palestine	No rule found
Panama	In some cases	A business whose databases are transferred to third parties.
Papua New Guinea	No rule found
Paraguay	No rule found
Peru	Required	Every business that creates a personal database, except for purely personal or family use.
Philippines	Required	Every person or business involved in the use of personal data must keep records that describe its data systems, with no size threshold. Registration with the authority is a separate duty.
Poland	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Portugal	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Puerto Rico	No rule found
Qatar	In some cases	The law sets no register of uses. Every business must have internal systems to manage personal data and must run audits, and the official guidance says these should be documented.
Republic of the Congo	Required	Every business or provider that uses personal data.
Rhode Island	Something similar	No record of data uses is required. Above the law's thresholds, a business needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Romania	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Russia	Required	Every company that uses personal data, with no size limit.
Rwanda	Required	Every business or provider that uses personal data.
Saint Kitts and Nevis	No rule found
Samoa	No rule found
San Marino	Required	Any business or provider, unless it has fewer than 250 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
Saudi Arabia	Required	Every business must keep a record of its uses of data for as long as the data is used and for five years after that.
Senegal	No rule found
Serbia	Required	Any business or provider, unless it has fewer than 250 staff and its use of data is occasional, not high risk and without sensitive or criminal offence data.
Seychelles	Required	Every business or provider that uses personal data.
Sierra Leone	No rule found
Singapore	In some cases	There is no general register. Every business must have data protection policies and practices. A business that relies on legitimate interests or consent by notice must first carry out a written risk assessment.
Sint Maarten (Dutch part)	No rule found
Slovakia	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Slovenia	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Solomon Islands	No rule found
South Africa	Required	Every business, whatever its size.
South Korea	In some cases	There is no general register for private businesses. Every business must have an internal security plan and access logs, and a business that uses pseudonymised data must keep records of that use.
Spain	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Spain: Catalonia	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Sri Lanka	Required	Every business must have a data protection programme with catalogued records showing how it follows the law. The law is not yet in operation for sites.
Suriname	No rule found
Sweden	Required	Any business or provider; with fewer than 250 staff, only uses of data that are regular, risky, sensitive or about criminal offences must be recorded.
Switzerland	In some cases	A business or provider with at least 250 staff, or a smaller one or an individual that uses sensitive data on a large scale or carries out high-risk profiling.
Syria	Required	Every business and every provider working for it must keep a dedicated record, with no size threshold in the text read.
Taiwan	In some cases	There is no general register. A business must take security measures, which may include use records, and must record the facts of a data incident.
Tajikistan	Something similar	No record of data uses is required. A business must be able to show proof of consent and follow the list of personal data approved by the authority.
Tanzania	No rule found
Texas	Something similar	No record of data uses is required. A business that is not a small business under the federal definition needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Thailand	Required	Every business must keep records of its use of data. Small businesses and non-profits are exempt from most of the content, unless the use is regular, risky or involves sensitive data. Providers keep their own records.
Timor-Leste	No rule found
Togo	In some cases	Only businesses that appoint a data protection correspondent.
Tonga	No rule found
Trinidad and Tobago	No rule found
Tunisia	No rule found
Turkey	In some cases	Every business that must join the VERBIS registry, including all businesses based abroad; a business in Turkey is exempt below 50 staff and TRY 100 million balance sheet, or below 10 staff and TRY 10 million if sensitive data is its main activity.
Turkmenistan	Required	Every business must approve a list of the personal data it needs for its tasks.
Tuvalu	No rule found
Ukraine	In some cases	A business whose use of data carries a particular risk, such as sensitive data.
United Arab Emirates	Required	Every business and every provider working for it must keep a record of the personal data it handles. The law sets no size threshold.
United Kingdom	Required	Any business or provider, unless it has fewer than 250 staff and its use of data is occasional, low risk and without sensitive or criminal offence data.
United States: California	Something similar	No record of data uses is required. Above the law's thresholds, a business keeps a log of consumer requests for 24 months, and a written risk assessment if it sells or shares data or uses sensitive data.
United States: states without a comprehensive privacy law	No rule found	These states have no general privacy law, so no record of data uses or risk assessment applies.
Uruguay	Required	Every business with a database, including a business abroad that targets people in Uruguay. Every business and provider must also document its measures.
Uzbekistan	In some cases	A business must register personal data bases that must stay in Uzbekistan, and must name a person in charge who follows the model procedure. Some bases are exempt.
Vatican City	In some cases	Only the Governorate of Vatican City State and its providers; an ordinary site is not covered.
Vermont	No rule found	No record of data uses is required. From 1 January 2028, a business above the law's thresholds needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Vietnam	In some cases	Every business must prepare a data impact file. Micro businesses are exempt and small businesses may wait until 2031, but not if they sell data services, use sensitive data, or hold data on 100,000 people or more.
Virginia	Something similar	No record of data uses is required. Above the law's thresholds, a business needs a written risk assessment for targeted advertising, selling data, sensitive data or risky profiling.
Yemen	No rule found
Zambia	Required	Every business or provider that uses personal data.
Zimbabwe	No rule found

By kind of site

Your first lines depend on what your site does.

An online shopCustomers, orders, payment, delivery A SaaSAccounts, support, your customers’ data A business siteContact forms and quotes A non-profitMembers, donors, volunteers

Start from a first draft

Gather these facts and copy our prompt into your AI tool. The prompt tells it to use only your facts and to end with a list of points to check.

Your company
Your countries
Your activities
Who receives data
Durations
Your providers

A draft from an AI is not legal advice. Read it again with your lawyer or legal adviser before you use it.

See the prompt

You help me prepare the record of processing of my company, as a table.

My facts:
- Company: [legal name, address, contact person]
- Countries where I work: [list]
- My activities with personal data: [customers, newsletter, website forms, staff, suppliers]
- For each activity: why I do it, whose data, which data, who receives it, where it goes, how long I keep it, how it is protected: [facts]
- Providers: [host, web agency, mail tool, accounting, payroll]

Rules for you:
- Use only the facts I give you. Do not invent a company name, a tool, a country, a duration or a legal basis.
- If a fact is missing, write [TO COMPLETE] and list it at the end.
- Write in plain words, in short sentences.
- End with a list called "Points to check", with everything a lawyer should read again.

Your other documents

See them side by side

PublicPrivacy policySays what you do with people’s data, and what their rights are.PublicCookie policyLists your cookies. Cookie Rocks writes it for you.Kept on your siteProof of consentShows what each visitor chose, and when.InternalProcessor agreementSets out what your agency, host or mail tool may do with data.

30 days free

Try the complete plugin. Nothing breaks on day 31.

no card, no catch

Every feature, every update and support, for 30 days. Setting it up takes a few minutes; the month gives you time to get the purchase through your accounting.

During the trial: everything, including the full settings and the scans
After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
What waits for a key: most settings, updates and support

How the trial works, in detail

Get your trial key

Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.