The record of processing activities lists every recurring way your company uses personal data: what it is for, whose data it is, where it is held, the legal reason you rely on, and how long you keep it. Other registers hang off it. A lawful basis, a retention rule and a person are each linked to an activity.
Who can do this
An owner, editor or contributor of your workspace can add and edit activities. A viewer can see them. This register is on every plan.
Find the register
Open Records & controls → Processing activities.
The bar at the top shows the share of activities with all four essentials recorded: a purpose, a department, a legal reason and a deletion date. It counts what is written down. It is not a verdict on whether the processing is lawful.
The tabs are Everything, Missing essentials, Sensitive data, Review due, For someone else and Child data unanswered. You can also search and filter by department.
Each row lists what is missing, worst first. A missing legal reason or deletion date is listed before a missing purpose or department, because those two matter most.
Add an activity
Press Add an activity. There are three sections.
- Activity details: the Activity name and Business purpose, the Activity owner, and a Privacy reviewer who is not the owner. Under Processing role, choose Data controller if you decide what happens to the data, or Data processor if you do it for another company.
- Data sources & locations: the systems or paper locations that hold it, whether Children’s data is involved, the Data subject categories, and any Special categories of data.
- Lawful basis & retention: choose the Lawful basis and the Retention period.
Write the purpose as if a customer will read it. "Business purposes" says nothing.
The rail shows What a complete entry needs and the Related records to review, such as a balancing test, an impact assessment or a line in your privacy notice. These are not created for you.
Press Create activity. If some answers are still missing, press Save as draft instead. The activity is saved as an incomplete record and the missing details stay visible.
The pairing Asiri will not save
If you tick Health, Biometric or Religion or politics and choose any lawful basis other than Consent, Asiri will not save the activity, even as a draft. Press Move it onto consent or remove the category. Check the legal position with your DPO.
Retention
Choosing 12 months, 24 months after last activity or 7 years records that period as your own decision. Nothing is deleted on it until a deletion is set up.
If A law or a regulator fixes it, no rule is written here. Record it in the retention register, where you name the law, the clause, the records it covers and the event the period runs from. Not sure yet writes no rule.
On the activity
The activity page shows any gaps at the top, with a button to close each one, and an Incomplete record badge until they are closed. The sections are The data, Why you’re allowed, How long you keep it, Related records and History.
- If no legal reason is recorded, press Record a legal reason.
- If no deletion date is recorded, press Set a deletion date.
- If the basis is Our own business interest, a balancing test is needed, and a second person must approve it.
Press Edit to change the activity. Press Export the register on the register page to export it.
Common questions
"Does a full bar mean we are compliant?" No. It counts fields that are filled in. An activity can be fully documented and still rest on the wrong basis.
"Is an activity with no review date overdue?" No. Only an activity whose review date has passed appears under Review due.
"What does For someone else mean?" Activities where you are the processor, carrying out work that another company decides.