A record of processing activities describes what data the company processes, why and with whom it shares it. For advertisers, pixels, lists and analytics tools are processing activities that merit their own entry. A simple template avoids gaps and prepares the company for any question.
The essentials in a definition
The record of processing is a document listing personal-data processing activities: purpose, data categories, recipients, retention periods and security measures. For advertisers, it pays to include pixels, customer lists, analytics and email tools. The GDPR provides for the record in many situations, and the CNPD and European Commission offer guidance; a simple template helps keep it up to date.
What it is and why it helps
It is an internal document listing, for each activity, the purposes, categories of data, recipients, retention periods and security measures. In many companies it is mandatory or strongly recommended, and it is the basis for any answer to complaints or audits.
For marketing it forces you to think about what is collected and why, which often reveals forgotten processing.
Which advertising activities to record
Pixels and tags on the site (per platform). Customer lists uploaded to platforms. Forms and leads. Analytics and heatmap tools. CRM and email automation. Arrangements with agencies or freelancers.
For each, record the purpose, legal basis, data involved, who has access and for how long it is kept.
Recording data processing in advertising
- List pixels, lists, forms and tools
- Fill in purpose, legal basis and data
- State recipients and retention periods
- Review quarterly and with each new campaign
A simple template
A sheet with columns: activity, purpose, legal basis, data categories, data subjects, recipients, destination country, retention period, security measures, owner. One line per activity is enough.
Start with the main activities and complete it as you go. An incomplete but honest record is better than none.
Whoever knows what data they process answers any question better.
Keeping it up to date
Assign an owner. Review the record every quarter and whenever you add a new tool or campaign. Build the check into the campaign launch process.
Validate with whoever handles data protection. The record should reflect what is actually done, not what you would like to do.
Decision table
| Field | What to record | Example |
|---|---|---|
| Activity | Description of the processing | Remarketing with customer list |
| Purpose and legal basis | What for and why it is permitted | Marketing, with consent |
| Data and data subjects | Categories and who they are | Hashed customer email |
| Recipients, retention and security | Who receives, how long and how protected | Platform X, 12 months, restricted access |
Common mistakes to avoid
- Outdated record. Review with each new pixel, tool or list.
- Too generic. Describe concrete activities, not “marketing” in general.
- Nobody responsible. Assign someone to maintain it.
How to measure the result
Review the record quarterly and whenever you launch a new tool; track the number of processing activities without a documented legal basis (should be zero).
Limits and exceptions
The record of processing is not an end in itself: a perfect document does not protect if it does not reflect reality or is not used. In small SMEs, the format can be simple, but must be true. The legal obligation to keep a record depends on the case. Consult the supervisory authority’s guidance and, in case of doubt, seek legal support.
Illustrative example
Illustrative example: an SME creates a sheet with one row per processing (remarketing pixel, customer list, email, analytics) and a column for legal basis and retention. It gets marketing and IT together to fill it in within two hours. It discovers a forgotten pixel and a list with no clear legal basis, and fixes both.
Frequently asked questions
Is this record mandatory?
In many situations it is mandatory or recommended. Check your case with whoever handles data protection.
What format should I use?
A simple spreadsheet with the essential columns.
Who should fill it in?
Whoever runs the activity, with support from whoever handles data protection.
Does an SME need a record?
It depends on size and type of processing; it is good practice even when not mandatory. Confirm the applicable rules.
Who should keep the record?
A designated person, with support from marketing, IT and legal.
A simple processing record (activity, purpose, legal basis, data, recipients and retention) helps control pixels, lists and tools and demonstrate compliance.
Sources and recommended reading
- General Data Protection Regulation (GDPR)
- Portuguese Data Protection Authority (CNPD)
- European Commission: data protection
Last editorial review: October 2026. Informational content; always confirm current conditions in the official sources before deciding.