Record of processing activities template for accountancy practices
The written record of how your firm uses personal information, as Article 30 of the UK GDPR requires. This record of processing activities template is one Excel workbook with the rows already filled in for a typical practice, so you check and adjust rather than start from a blank sheet.
UK practicesGet this pack and 100 more for $129
What the record looks like
Who needs one
Article 30 lets organisations with fewer than 250 staff skip the record, but only when their processing is occasional, unlikely to put people at risk and free of special category or criminal offence data. An accountancy practice meets none of those conditions, so even a sole practitioner needs a record.
- You prepare accounts, tax returns or payroll for clients, which is regular processing
- You carry out anti-money laundering checks, which can involve criminal offence data
- You run payroll that includes sickness or parental leave, which is health information
- You employ staff or take on job applicants
- Your professional body or the ICO asks to see how you handle personal information
How to use the record of processing activities template
- Fill in the firm details. Name, address, contact details, your data protection lead and your ICO registration number.
- Go through the activity rows. Change each one to match what your firm does, and delete any activity you don't carry out.
- Add your own activities. Use the empty rows for anything else, such as CCTV, a client portal or bookkeeping for charities.
- Fill in the transfer column. Check where your software providers store data and note the safeguard for anything held outside the UK.
- Clear the red flags. The Check column shows OK once every required column in a row is filled in.
- Review it once a year. Put the review date on the firm details sheet, and add a row whenever you start a new service.
Questions
What is a record of processing activities?
It is a written record, kept on paper or electronically, of the personal information your firm uses: why you use it, whose it is, who you share it with, how long you keep it and how you protect it. Article 30 of the UK GDPR sets out what it must contain.
Do small firms need a record of processing activities?
The exemption for organisations with fewer than 250 staff only applies if the processing is occasional, unlikely to put people at risk and does not include special category or criminal offence data. Accountancy work is regular and AML checks can involve criminal offence data, so practices of every size need a record.
What must a record of processing activities include?
Your firm's name and contact details, the purposes of the processing, the types of people and data, who receives the data, any transfers outside the UK, how long you keep each type of data where possible, and a general description of your security measures.
Does the ICO need to see the record?
You don't send it to the ICO, but you must make it available if the ICO asks for it.
What is the difference between a record of processing and a privacy notice?
The record is an internal document that covers everything your firm does with personal information. A privacy notice is written for the people whose data you use and tells them what they need to know about their own information.
Also in the UK GDPR pack for practices
Who it's for
Sole practitioners and small accountancy firms that want their Article 30 record in one place, filled in for practice work.
Last checked
Checked against Article 30 of the UK GDPR on legislation.gov.uk in November 2026.
