Records of processing for your AI tools: a GDPR Article 30 entry sheet for small EU businesses (one row per tool, the 7 required fields, 3 filled examples)
What you get: a finished records-of-processing entry sheet for AI tools: 7 required lines and 3 recommended ones to fill once per AI tool that touches personal data (a meeting note-taker, a website chatbot, a CV ranking feature, a writing assistant staff paste customer emails into), each tied to the GDPR article it comes from. Plus a three-question test for the under-250 exemption, the status of the proposed change to that exemption, three filled example rows (made up, to show the level of detail), and a list of what to ask each supplier.
The short answer
Article 30 GDPR requires each controller to keep a written record (electronic is fine) of its processing activities, and to show it to the data protection authority on request (Article 30(3) and (4)). The record must contain the controller's details, the purposes, the categories of people and of personal data, the recipients, any transfers outside the EU with their safeguards, and, where possible, deletion periods and a general description of security measures (Article 30(1)(a) to (g)).
Organisations with fewer than 250 employees are exempt only if the processing is not likely to result in a risk to people's rights and freedoms, is occasional, and does not include special category or criminal-offence data (Article 30(5)). An AI tool that staff use every week on customer, applicant or employee data is not occasional, so in practice it needs an entry. The Article 29 Working Party position paper on Article 30(5) (19 April 2018) says a small business keeps records only for the processing caught by one of those conditions, not for everything.
Is the exemption changing?
In May 2025 the Commission proposed, in its fourth simplification omnibus, to extend the Article 30(5) exemption to organisations with fewer than 750 employees, with records still needed for processing likely to result in a high risk under Article 35. The EDPB and EDPS welcomed the aim in a joint opinion on 9 July 2025 and asked for clarifications. The European Parliament's report and the Council's mandate both use fewer than 1,000 employees. As far as we could check on 21 October 2026, the amending regulation had not been published in the Official Journal, so the current 250 rule applies. Keep your AI entries: under every version of the proposal, high-risk processing (for example, AI that screens job applicants or scores credit) still needs a record.
Three-question exemption test (fewer than 250 staff)
- Is the processing occasional? A tool used in day-to-day work is not. A one-off test with made-up data is.
- Is it likely to result in a risk to people? Recordings of calls, profiles of customers, ranking of applicants, monitoring of staff: treat as yes.
- Does it include special category or criminal-offence data? Health notes in a transcript, biometric voice or face data, background checks: yes.
Any yes: fill the sheet for that tool. Three no answers: write one line saying why, and date it.
Entry sheet (fill once per AI tool)
| # | Line | What to write for an AI tool | Source |
|---|---|---|---|
| 1 | Controller and contact (required) | Your business name, address and a contact email; any joint controller; your EU representative if you are outside the EU; your data protection officer if you have one. | Art. 30(1)(a); Art. 27, 37 |
| 2 | Purpose (required) | One purpose per entry, in plain words: 'summarise sales calls', 'answer customer questions on the website', 'rank job applications'. If the supplier may use your data to improve or train its models, write that as its own purpose and say whether you switched it off. | Art. 30(1)(b); Art. 5(1)(b) purpose limitation |
| 3 | People and data (required) | Whose data (customers, prospects, applicants, staff, call participants) and which data: names and contact details, the prompts and files staff upload, audio or video, transcripts, the AI's outputs about a person, usage logs. Flag any health, biometric or other special category data separately. | Art. 30(1)(c); Art. 9(1) |
| 4 | Recipients (required) | The AI supplier (usually your processor), its sub-processors as listed in its data processing terms, and anyone you share outputs with (CRM, payroll provider, accountant). Note whether a contract under Article 28 is in place and where it is filed. | Art. 30(1)(d); Art. 28(3) |
| 5 | Transfers outside the EU/EEA (required where applicable) | Each country where the supplier or a sub-processor stores or accesses the data, and the basis: an adequacy decision (for a US supplier, check it is on the Data Privacy Framework list) or standard contractual clauses. For the rare one-off transfers under the second subparagraph of Article 49(1), record the safeguards. | Art. 30(1)(e); Art. 45, 46(2)(c), 49(1) |
| 6 | Deletion periods (where possible) | How long chat history, uploads, recordings, transcripts and logs are kept, by you and by the supplier, and who deletes them. Take the supplier's figure from its terms, not from memory. If the tool is high-risk under the AI Act, you as deployer must keep its automatically generated logs for at least six months. | Art. 30(1)(f); Art. 5(1)(e); AI Act Art. 26(6) |
| 7 | Security measures (where possible) | A short description: single sign-on or two-factor login, who has access, workspace or enterprise plan settings, encryption stated by the supplier, training-on-your-data switched off, staff rules on what may be pasted in. | Art. 30(1)(g); Art. 32(1) |
| 8 | Legal basis (recommended) | Not a field in Article 30, but you need it for the privacy notice anyway: contract, legitimate interests (keep the balancing note), consent or legal obligation. | Art. 6(1); Art. 13(1)(c) |
| 9 | DPIA and Article 22 flags (recommended) | DPIA done? Y/N and date. Does the tool make solely automated decisions with significant effects? Link the decision sheet if so. | Art. 35; Art. 22 |
| 10 | AI register link (recommended) | The tool's entry in your AI register, your AI Act role (usually deployer) and its risk tier, so the GDPR record and the AI Act record point at each other. | AI Act Art. 3(4), 26 |
Lines 1 to 7 are the controller record under Article 30(1). If you are an agency or freelancer running an AI tool on a client's data on the client's instructions, you are usually a processor and keep the shorter processor record instead: your details and each client's, the categories of processing you do for each client, transfers, and security (Article 30(2)).
Three filled example rows
| Tool | Purpose | People and data | Recipients | Transfers | Deletion | Security |
|---|---|---|---|---|---|---|
| [AI meeting note-taker] | [record and summarise sales and support calls] | [customers, prospects, staff: voice, transcript, summary, names, emails from the calendar invite] | [supplier as processor; its speech-to-text and hosting sub-processors; summaries copied into CRM] | [US: supplier on the Data Privacy Framework list (checked [date]); SCCs for [sub-processor]] | [recordings 30 days, transcripts 12 months, set in admin settings] | [SSO; only sales team; bot joins only when host enables it; training on our data off] |
| [website chatbot] | [answer product and order questions] | [visitors and customers: chat text, order number, email if given] | [chatbot supplier; its model provider as sub-processor; helpdesk] | [per supplier's sub-processor list: [countries]] | [chat logs 90 days] | [admin 2FA; chatbot cannot see payment data; disclosure that visitors are talking to AI shown] |
| [CV ranking in applicant tracking system] | [sort applications for [role]] | [applicants: CV, cover letter, scores and ranking] | [ATS supplier; hiring managers] | [EU hosting stated in contract] | [6 months after the role is filled unless the applicant agrees to longer] | [role-based access; manager reads every CV before rejection] |
The three rows above are made-up examples to show the level of detail, not a statement about any real product. Fill in the bracketed parts from your own supplier's terms.
Ask each AI supplier (in writing)
- Your data processing terms (Article 28) and the current sub-processor list with countries
- Where data is stored and accessed from, and the transfer basis for each country
- Default retention for chat history, uploads, recordings and logs, and whether you can shorten it
- Whether our data is used to train or improve your models, and how to switch that off
- Security measures you state for our plan (login, encryption, access logging)
More questions for suppliers: AI vendor questions for deployers and AI supplier contract clauses.
Do this week
- List every AI tool staff use with personal data, including free accounts (SME AI inventory template)
- Run the three-question test per tool and note the answer
- Fill lines 1 to 7 from the supplier's terms; ask for anything missing
- Switch off training on your data where the plan allows, and record it in line 7
- Set a date to review the sheet when you add or drop a tool, and at least once a year
This sheet is a starting point, not a legal opinion or proof of compliance. GDPR references are to Regulation (EU) 2016/679 (Article 30 text checked on 21 October 2026). The status of the proposed Article 30(5) change was checked on 21 October 2026 against the EDPB's 9 July 2025 news item and the European Parliament's Legislative Train page; the Council's press pages did not load from our checker, so check the official source (EUR-Lex, Official Journal) for any later adoption. The AI Act Article 26 duty to keep logs was checked against the Commission's AI Act Service Desk. National authorities publish their own record templates; your authority's version may ask for extra fields. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Many small clients assume the 250-employee rule means "no records". At the next review, run the three questions with them for each AI tool, hand over this sheet with the client AI inventory workshop, and tell them the proposed change has not yet replaced the current rule. Stay inside your professional rules and pass legal drafting to a lawyer.
Keep the record next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, pick your role (usually deployer), and attach the filled Article 30 entry and the supplier's data processing terms as evidence records.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then fill one entry per tool. Related: Article 22 decision sheet · meeting note-taker setup sheet · AI Act logs for deployers · staff AI use policy · provider or deployer check.
Sources
- Regulation (EU) 2016/679 (GDPR): Articles 5, 6, 9, 13, 22, 27, 28, 30, 32, 35, 37, 45, 46, 49
- Article 29 Working Party: position paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR (19 April 2018)
- EDPB news, 9 July 2025: EDPB and EDPS joint opinion on the proposed simplification of record-keeping (Article 30(5))
- European Parliament Legislative Train: Omnibus IV, simplifying measures for SMEs and small mid-caps
- European Commission AI Act Service Desk: Article 26, obligations of deployers (logs kept at least six months)
- Data Privacy Framework list (US organisations participating in the EU-US Data Privacy Framework)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.