AI Governance Engineer
GitHub

GDPR Art. 30: records of processing activities

Controllers and processors keep a record of the processing activities under their responsibility

By Reviewed

From clause to evidenceThe chain from GDPR Art. 30 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: General Data Protection Regulation (EU) 2016/679, Art. 30ClauseGDPRArt. 30Duty holder: Controller; processorDuty holderControllerApplies from: 2018-05-25 (In force)Applies from2018-05-25In forceArtefact: Records generated per processing moment from the registry and data cardsArtefactRecordsgenerated per…Layers: Layer 02 Inventory & Transparency and Layer 05 Assurance & Continuous ComplianceLayersLayer 02Layer 05Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence recordv1Same topic in 19 frameworks (44 clauses): EU AI Act, ISO 42001, China AI Labelling, China GenAI Measures, China DeepSynthesis, GPAI Code, GDPR and 12 moreAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from GDPR Art. 30 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: General Data Protection Regulation (EU) 2016/679, Art. 30ClauseGDPR · Art. 30Duty holder: Controller; processorDuty holderControllerApplies from: 2018-05-25 (In force)Applies from2018-05-25 · In forceArtefact: Records generated per processing moment from the registry and data cardsArtefactRecords generated per processing…Layers: Layer 02 Inventory & Transparency and Layer 05 Assurance & Continuous ComplianceLayersLayer 02Layer 05Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence record v1Same topic in 19 frameworks (44 clauses): EUAI Act, ISO 42001, China AI Labelling, ChinaGenAI Measures, China Deep Synthesis and 14…As of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-GDPR-ART30. Drawn from chapter 08.
Text alternative
  • Clause: GDPR, Art. 30.
  • Duty holder: Controller.
  • Applies from: 2018-05-25, In force.
  • Artefact: Records generated per processing….
  • Layers: Layer 02, Layer 05.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • The same topic in 19 other frameworks; the crosswalk section below links each clause.
When this obligation appliesThe date of AIGE-OBL-GDPR-ART30 on a time axis, against its review date 2026-09-24.Earlier2024202620282030As of 2026-09-242018-05-25 · In force2018-05-25 · In forceSource: Obligation register(chapter 08)
When this obligation appliesThe date of AIGE-OBL-GDPR-ART30 on a time axis, against its review date 2026-09-24.2018-05-25 · In force2024202620282030EarlierAs of 2026-09-242018-05-25 · In forceSource: Obligation register (chapter 08)
When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.
Data table: the dates
Dates of AIGE-OBL-GDPR-ART30
DateStepDetail
2018-05-25In force
Id
AIGE-OBL-GDPR-ART30
Instrument
General Data Protection Regulation (EU) 2016/679 law
Clause
Art. 30
In scope
Controller; processor
Authority
National data protection authority
Applies from
In force

The artefact that evidences it

Records generated per processing moment from the registry and data cards.

What this obligation connects toGDPR Art. 30 and its 20 relations: 1 open controls, 19 same crosswalk topic.DirectColour: stack layer of the pattern or control01 Govern-as-CodeGDPR Art. 30Open controls (1)AIGE-CTL-DATA-007 Special-Category Data Conditions · DirectSpecial-Category Data…Same crosswalk topic (19)AI Verify 1.1.6, 1.7.2, 1.1.1 · Core clauseAI VerifyCSA AICM MDS-03, MDS-04 · Core clauseCSA AICMChina AI Labelling Label Art. 4, Label Art. 5 · Core clauseChina AI LabellingChina Deep Synthesis DeepSyn Art. 16, DeepSyn Art. 17 · Core clauseChina Deep SynthesisChina GenAI Measures GenAI Art. 12, GenAI Art. 19 · Core clauseChina GenAI MeasuresCoE Convention CoE Art. 14(2), CoE Art. 15(2) · Core clauseCoE Convention+13 more+13 more: EU AI Act Art. 11, Art. 13, Art. 53, Art. 50, Art. 86, Art. 18, Art. 43, Art. 53(1)(d), Art. 50(2), 50(4), G7 Code G7 Action 3, GAO AI Accountability 1.9, 3.5, 1.7, GDPR Arts. 13–14, GPAI Code Transparency 1.1, Transparency 1.2, ISO 42001 7.5, A.6, A.8, Korea AI Act Art. 31, Art. 34(1)(2), OECD AI Principles OECD 1.3, Singapore GenAI GenAI 3, UK ATRS ATRS Tier 1, ATRS 2.2, China Algo. Rec. AlgoRec Art. 16, GB/T 45654 GB/T 45654 Content labelling, NIST AI RMF MAP 1, MEASURE 2.8, MAP 1.6, MEASURE 2.9
What this obligation connects toGDPR Art. 30 and its 20 relations: 1 open controls, 19 same crosswalk topic.DirectColour: stack layer of the pattern or control01 Govern-as-CodeOpen controls (1)AIGE-CTL-DATA-007 Special-Category Data Conditions · DirectSpecial-Category Data…Same crosswalk topic (19)AI Verify 1.1.6, 1.7.2, 1.1.1 · Core clauseAI VerifyCSA AICM MDS-03, MDS-04 · Core clauseCSA AICMChina AI Labelling Label Art. 4, Label Art. 5 · Core clauseChina AI LabellingChina Deep Synthesis DeepSyn Art. 16, DeepSyn Art. 17 · Core clauseChina Deep SynthesisChina GenAI Measures GenAI Art. 12, GenAI Art. 19 · Core clauseChina GenAI MeasuresCoE Convention CoE Art. 14(2), CoE Art. 15(2) · Core clauseCoE Convention+13 more+13 more: EU AI Act Art. 11, Art. 13, Art. 53, Art. 50, Art. 86, Art. 18, Art. 43, Art. 53(1)(d), Art. 50(2), 50(4), G7 Code G7 Action 3, GAO AI Accountability 1.9, 3.5, 1.7, GDPR Arts. 13–14, GPAI Code Transparency 1.1, Transparency 1.2, ISO 42001 7.5, A.6, A.8, Korea AI Act Art. 31, Art. 34(1)(2), OECD AI Principles OECD 1.3, Singapore GenAI GenAI 3, UK ATRS ATRS Tier 1, ATRS 2.2, China Algo. Rec. AlgoRec Art. 16, GB/T 45654 GB/T 45654 Content labelling, NIST AI RMF MAP 1, MEASURE 2.8, MAP 1.6, MEASURE 2.9GDPR Art. 30
What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.
Data table: every relation
Relations of AIGE-OBL-GDPR-ART30
FamilyItemRelation
Open controlsAIGE-CTL-DATA-007 Special-Category Data ConditionsDirect
Same crosswalk topicAI Verify 1.1.6, 1.7.2, 1.1.1Core clause
Same crosswalk topicCSA AICM MDS-03, MDS-04Core clause
Same crosswalk topicChina AI Labelling Label Art. 4, Label Art. 5Core clause
Same crosswalk topicChina Deep Synthesis DeepSyn Art. 16, DeepSyn Art. 17Core clause
Same crosswalk topicChina GenAI Measures GenAI Art. 12, GenAI Art. 19Core clause
Same crosswalk topicCoE Convention CoE Art. 14(2), CoE Art. 15(2)Core clause
Same crosswalk topicEU AI Act Art. 11, Art. 13, Art. 53, Art. 50, Art. 86, Art. 18, Art. 43, Art. 53(1)(d), Art. 50(2), 50(4)Core clause
Same crosswalk topicG7 Code G7 Action 3Core clause
Same crosswalk topicGAO AI Accountability 1.9, 3.5, 1.7Core clause
Same crosswalk topicGDPR Arts. 13–14Core clause
Same crosswalk topicGPAI Code Transparency 1.1, Transparency 1.2Core clause
Same crosswalk topicISO 42001 7.5, A.6, A.8Core clause
Same crosswalk topicKorea AI Act Art. 31, Art. 34(1)(2)Core clause
Same crosswalk topicOECD AI Principles OECD 1.3Core clause
Same crosswalk topicSingapore GenAI GenAI 3Core clause
Same crosswalk topicUK ATRS ATRS Tier 1, ATRS 2.2Core clause
Same crosswalk topicChina Algo. Rec. AlgoRec Art. 16Related clause
Same crosswalk topicGB/T 45654 GB/T 45654 Content labellingRelated clause
Same crosswalk topicNIST AI RMF MAP 1, MEASURE 2.8, MAP 1.6, MEASURE 2.9Related clause

Patterns that build it

No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Documentation and transparency

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

Source

Chapter 08, section The GDPR, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). GDPR Art. 30: records of processing activities (AIGE-OBL-GDPR-ART30). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art30. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{GDPR Art. 30: records of processing activities (AIGE-OBL-GDPR-ART30)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art30},
  note         = {Version 0.5.0}
}