Maintain a processing record

Both the data controller and the data processor are obliged to maintain a record or a list of instances of personal data processing. These records are to be in writing, accessible in an electronic format and kept up to date. The records are to be made accessible to Swedish Authority for Privacy Protection upon request. What the list is to contain is described in Article 30 of the General Data Protection Regulation.

Exemption from the obligation to maintain a record

There is an exemption from the obligation to maintain a record and it applies to companies and organisations with fewer than 250 employees. The exemption applies if all three of the following criteria are met.

Companies and organisations with fewer than 250 employees are not obliged to maintain a record if the personal data processing:

• is unlikely to result in a risk to the rights and freedoms of data subjects,
• is occasional, and
• does not include sensitive data as referred to in Article 9 or personal data relating to criminal convictions and offences as referred to in Article 10.

In the opinion of Swedish Authority for Privacy Protection every instance of processing must be judged individually. If any of the instances of processing carried out is not covered by the exemption, a record of the processing must be kept, while the instances of processing that meet the above criteria do not need to be included in the record. For example, the processing carried out for the administration of employees' wages and salaries is recorded since it is not occasional at the same time as another type of processing does not necessarily need to be recorded. Regardless of the exemption, Swedish Authority for Privacy Protection recommends that organisations maintain records to be able to keep track internally of the personal data processing carried out.