Records of processing review: what the decision maker looks at
A records of processing review checks whether a register of processing activities is complete, current and internally consistent. The reviewing officer — usually a data protection lead or a supervisory case handler — compares each entry against the systems and vendors actually in use. It then flags gaps and decides whether the register can be relied on as it stands, or needs correction first.
What is actually being checked
The review does not test whether processing is lawful. It tests whether the paperwork describing that processing matches reality. A register that lists a vendor no longer under contract, or omits one that is, fails the review regardless of how carefully the underlying processing was designed.
Three qualities are checked in sequence: completeness, accuracy and traceability. Completeness asks whether every processing activity appears. Accuracy asks whether each entry matches the current system architecture. Traceability asks whether each entry links to a retention rule, a legal basis note and an owner inside the organisation.
A register that misses one integration usually misses the vendor contract behind it too. The same blind spot surfaces during How post-closing integration IP licence runs in practice, where an acquired entity's records turn out to be several versions behind its system landscape.
An owner named on paper but no longer in the role is treated the same way as a missing entry. The register is only as good as the person who can answer for each line in it.
Practical consequence
A register found deficient during review is not simply corrected quietly. The reviewing officer normally issues a list of required amendments with a deadline attached, and treats the review file as evidence of the organisation's baseline accountability. A weak register found once tends to invite a closer look at other compliance files in the same cycle.
Where the review is triggered from outside — by a supervisory authority rather than an internal audit — the deadline is shorter and the tolerance for partial answers is lower. Internal reviews allow room to fix entries iteratively; external ones do not.
A file that closes cleanly the first time carries weight in any later dealing with the same authority. A file reopened twice for the same gap does the opposite.
Stages, documents and timing
| Stage | What happens | Typical duration |
|---|---|---|
| Request | Reviewing officer asks for the current register, the change log and named process owners | 1–3 working days to respond |
| Mapping | Entries checked against live systems, vendor list and data flow diagrams | 1–3 weeks |
| Gap list | Discrepancies written up with a required correction for each | 3–10 working days |
| Correction | Owners update entries, confirm retention and legal basis notes | 2–6 weeks, depending on scope |
| Sign-off | Reviewing officer confirms the register is closed for this cycle | Same week as final correction |
A narrow register — one system, one vendor — clears in a few weeks. A register spanning several jurisdictions and legacy systems can run for a full quarter before sign-off.
What to do
- Pull the register as it currently stands, together with the date of its last confirmed update.
- Assign one named owner per processing activity before the review starts, not after.
- Cross-check each entry against the active vendor and system list, not against the original design document.
- Prepare retention and legal basis notes as separate fields, ready to show on request.
- Set an internal deadline for corrections that is shorter than the one the reviewing officer is likely to give.
Contract-heavy reviews follow a similar rhythm to other structured procedures with fixed stages. The staged deadline structure in Benchmarking clause: stages and deadlines shows how such stages hold contract owners to account.
Who decides
Inside the organisation, the data protection lead decides whether the register is fit to close the cycle. Where a supervisory authority has opened the review, its case handler decides, and that decision is recorded in the case file rather than left informal.
Escalation beyond the case handler is rare and reserved for disputed findings. In most files, the decision is administrative rather than adversarial — a register either matches reality or it does not.
Forks
If the review is internal and routine, corrections can be phased across the quarter without a formal gap list. If it is triggered by an incident or a complaint, every gap is written up and dated, because the file becomes evidence.
If a vendor or processor does not respond to the information request within the set window, the reviewing officer escalates rather than waits. The same posture applies when When the other side moved first in this situation: delay by the other party shifts the initiative, it does not pause it.
If the organisation operates in a different regulated sector, the same review logic applies: documents first, deadlines second. See how it plays out for Update of the offering document token issuance what the.
Limit
This page describes the review mechanics, not the underlying question of whether a given processing activity is lawful in the first place. It does not set out what a compliant register must contain field by field, and it does not cover disputes over the review's outcome once it is closed.
It also does not cover cross-border transfer questions raised during the same review — those follow a separate assessment with its own document list.
Verified
This overview reflects the stages, documents and timing observed in review files, without citing a specific statute or regulator guidance document. Last checked: March 2025. No external source is linked on this page; the underlying legal basis for maintaining records of processing sits outside the scope of a procedural walkthrough.
Related publications
A closely related review process, with its own document list and timing, is covered in How transfer mechanism assessment data protection what the decision.
FAQ
How long does records of processing review take in practice?
A narrow register clears in two to four weeks. A register spanning several systems or jurisdictions can take a full quarter, mainly because correction, not mapping, is the slow stage.
Which documents are needed to start?
The current register, its change log, a live vendor and system list, and one named owner per processing activity. Missing owners are the most common cause of delay.
What happens if the other side does not respond?
The reviewing officer sets a short follow-up window and then escalates internally rather than waiting further. A non-response is treated as a gap in the register, not as a pause in the review.