On July 25, the French data protection authority published a new template of records of processing activities. The CNIL template of records is especially addressed to help small organizations and consists of a basic template to meet the most common needs that a processing of personal data may present.

Scope of the CNIL template of records of processing activities

The CNIL template of records is addressed to all entities or organisations that must comply with the GDPR which act as data controllers when processing personal data. 

At a first glance, the template is not adapted to register the activities carried out as a data processor. However, with a few adjustments it would also be possible to use it to register those processings.

Regarding the size of the organization to which it is addressed, the CNIL template is specially designed for self-employed individuals or freelancers and small businesses. While it could also be used by larger companies, since the records only contain the strictly necessary information mandated by law, it seems more suitable for small businesses.

Larger companies should consider including additional fields in the records that reflect how data flows, such as the means used to collect the data, store it, process it or erase it.

Content of the CNIL template of records

The template published by the French supervisory authority is included in a spreadsheet in ods format which is made up of 4 sections: (i) Tutorial; (ii) List of processings; (iii) Record template, and; (iv) Record example.

The “list of processings” provides you with an overview of the processings you carry out within your company. Conversely, the “record template” is a sheet designed to collect the information which is strictly necessary about a specific processing activity.

The “record example” is a record sheet filled in only for exemplifying purposes, so you should not use it for your own records. The CNIL template also includes a multitude of explanations and links to guides and resources, making it quite useful for entities or freelancers that do not have a lawyer or consultant specialised in data protection to advise them.

Download the CNIL template in French, English or Spanish

The CNIL template of records is available for download at its website, which you can access following this link: https://www.cnil.fr/fr/la-cnil-publie-un-nouveau-modele-de-registre-simplifie

Additionally, for those of you who are interested and want to use it, I have translated it into Spanish and English:

Changes in the translated versions of the CNIL template

When conducting the translations I did some changes to the template. Both the English and Spanish versions are presented with the following changes:

  • On tab 3 (Record template) “transfers outside the EU” were changed by “transfers outside the EEA”. The same change was made to the related comment (cell A58).
  • On tab 5, Japan was added as country which offers an adequate level of protection of personal data (cell D83).

Others also viewed…

Who does the GDPR apply to
GDPR representative in the EU. Personal data protection and privacy. European Union
GDPR data protection officer (DPO). When must be appointed, role, requirements, duties and salary
International data transfers. Transfers of data outside the EU
GDPR principles of data protection
Records of processing activities under the GDPR guidelines. Article 30. Templates and examples
special categories gdpr sensitive personal data
GDPR data subject rights
GDPR data protection impact assessment DPIA. Privacy
GDPR information security requirements and controls
GDPR fines and sanctions for breaching the law
GDPR and blockchain. Issues and solutions for ensuring compliance