Module 9 · 9.3

English

Nederlands English Deutsch Français Español

Record of processing activities, DPIA and completing the switch

Module 9: People and rules · Reading time: 12 minutes

Learning objective: After this lesson you can update the record of processing activities and the privacy notice after the switch, decide whether a DPIA is needed, have the old service properly deleted, and formally complete the switch with a final checklist.

Key concepts: record of processing activities (Art. 30), exception for fewer than 250 employees, DPIA (Art. 35), the data protection authority's DPIA list, privacy notice (Art. 13 and 14), recipients, transfer, obligation to report a personal data breach (Art. 33), deletion at the old service, confirmation of deletion, evaluation, final checklist

The switch isn't finished until the paperwork is right

Mail is flowing, files are in place, everyone is working in the new environment. Technically, you're done. But for the GDPR there's still work to do: your documentation still describes the old situation. If a customer asks a question, there's an audit, or a data breach happens, you want to be able to show how things actually stand now. This lesson completes the switch.

This is explanation, not legal advice.

The record of processing activities

Article 30(1) of the GDPR requires the controller to keep a record of processing activities. For each processing activity (for example "customer orders", "HR administration", "newsletter"), it records:

name and contact details of the controller (and, where applicable, the data protection officer);
the purposes of the processing;
the categories of data subjects and personal data;
the recipients, including processors;
transfers to countries outside the EEA, with the safeguards used;
the retention periods, where possible;
a general description of the security measures, where possible.

Does that also apply to a small organisation?

Article 30(5) contains an exception for organisations with fewer than 250 employees. But that exception doesn't apply if the processing is likely to pose a risk, if it is not occasional, or if it involves special category data (such as health data) or criminal conviction data. The Dutch data protection authority explains that, in practice, processing is rarely occasional: as soon as you have employees or regular customers, you're processing data structurally. For Bakkerij De Korrel, with payroll administration, customer orders and sick leave records, the exception therefore doesn't apply.

There is a European proposal to ease the record-keeping obligation for smaller organisations (the so-called Omnibus IV package; in June 2026 the Council and Parliament reached a provisional agreement). Until that takes effect, the current Article 30 applies. And even after that, an overview remains useful: you need it to be able to meet the rest of your obligations.

What do you update after the switch?

Go through each line of your record and update it:

Column	Example for De Korrel, before	After the switch
Recipients / processors	US office suite (mail, storage, chat)	European provider X (mail), European provider Y (files, calendar, chat)
Transfer outside the EEA	US, based on the DPF and standard contractual clauses	None (according to the DPA and sub-processor list)
Security	Two-factor authentication, encryption by the provider	Two-factor authentication for everyone, encryption in transit and at rest, weekly own backup
Retention period	"Unlimited" (nobody cleaned up)	Mail deleted after 7 years (tax retention obligation), job applications after 4 weeks (unless consent given)

A switch is a good moment to finally sort out your retention periods properly. In the Netherlands, tax records generally must be kept for seven years; for job application data, the Dutch authority advises, in principle, four weeks after the procedure ends. Check which periods apply in your own country and sector.

Do you need to do a DPIA?

A DPIA (data protection impact assessment) is a structured risk analysis carried out in advance. Article 35 requires a DPIA if a processing activity is likely to result in a high risk to data subjects, especially with new technology.

How do you know if that's the case?

The DPIA list. In 2019, the Dutch data protection authority published a list of seventeen types of processing for which a DPIA is always required. These include large-scale processing of health data, camera surveillance, monitoring of employees, communication data, location data, profiling and biometrics. Every EU data protection authority publishes its own DPIA list (Art. 35(4)), so check the list for your own country.
The European criteria. European data protection authorities have drawn up nine criteria (such as sensitive data, large scale, vulnerable data subjects, systematic monitoring, new technology). If a processing activity meets two or more of these, a DPIA is generally required.

For a bakery moving mail and files, a DPIA usually isn't required. For a GP practice moving patient communication to a new service, or a school with pupil data, it's a different story. Even when it isn't required, a brief risk analysis can be useful. The assessment from lesson 1.5 is a good starting point. If you already have a DPIA for the old service, update it.

The privacy notice

In your privacy notice, you tell data subjects (customers, job applicants, website visitors) how you handle their data (Art. 13 and 14). This includes the recipients or categories of recipients and any transfers outside the EEA. If it said "we use services from companies in the United States based on the Data Privacy Framework", update that. Don't change anything that isn't accurate: only state what you genuinely know for certain from the DPA and the sub-processor list.

Data breaches: know who to call

After the switch, your provider has changed, and so has the route in the event of a data breach. Set out in your procedure:

the contact address of the new provider for security incidents;
the period within which the provider informs you, according to the DPA;
who within your organisation decides whether to report it, since the report to the data protection authority must be made within 72 hours of discovery (Art. 33);
where you keep the data breach register: even breaches you don't have to report must be recorded internally (Art. 33(5)).

Completing things at the old service

Only cancel the old service once everything has been working well for a few weeks (lesson 3.3). After that:

Final check: has everything come across? Are there shared folders, forms or links that still point to the old service?
Export a final archive for your own records, if you want to keep it (for example, mail covered by a retention obligation). Store it encrypted.
Delete accounts and data at the old service, or have them deleted. Article 28(3)(g) requires the old processor to delete or return the data after the end of the service, at your choice. Ask for a confirmation of deletion and keep it with your record.
Clean up links: "log in with" links at other services, apps with access, and verification records in your DNS (lesson 4.3).
Update your record, your privacy notice and your data breach procedure (see above).

Evaluating

Plan a short evaluation with the ambassadors a month after the switch (lesson 9.1). What went well, what didn't, what will you do differently next time? Also note your exit plan for the new service (lesson 8.2) and put a date in your calendar to test it annually.

In practice: what this looks like at a provider

Many providers have a feature to download your data or have your account deleted. At WebOké, the WebOké manual explains how to download your data or have it deleted. At large US services, this is usually called "export data" and "delete account", and the administrator of an organisation account has their own export features. Check in advance how long the service keeps data in backups after deletion; this is often stated in the privacy notice or the DPA.

Final checklist

[ ] All items from the inventory (lesson 3.1) are in the new environment and have been checked
[ ] Data processing agreement(s) with the new provider(s) signed and kept on file (lesson 9.2)
[ ] Record of processing activities updated: recipients, transfers, security, retention periods
[ ] DPIA assessed (needed or not, and the reasoning recorded)
[ ] Privacy notice updated
[ ] Data breach procedure updated with new contact details
[ ] Old service cancelled, data deleted, confirmation kept on file
[ ] Links and old DNS records cleaned up
[ ] Backup of the new environment set up and tested (lesson 8.1)
[ ] Exit plan for the new service recorded (lesson 8.2)
[ ] Evaluation held

Summary

After the switch, update the record of processing activities: recipients, transfers, security and retention periods.
The exception for fewer than 250 employees rarely applies in practice; a proposal to ease it has not yet taken effect (as of November 2026).
A DPIA is required for high risk (DPIA list, European criteria); for ordinary office data, usually not.
Update your privacy notice and data breach procedure.
Have the old service delete your data and ask for confirmation.

Quiz

Exercise

Exercise E9.3: Complete your switch. For three processing activities in your organisation, update the entries in the record of processing activities (recipients, transfer, security, retention period), assess using the DPIA list and the European criteria whether a DPIA is needed, and fill in the final checklist.

Exercise E9.3: Complete your switch

Update three lines of the record of processing activities, assess the DPIA requirement, and go through the final checklist.

Three processing activities: name · purpose · categories of data · recipients/processors (new) · transfer outside the EEA (new) · retention period · security.

DPIA: does one of the processing activities fall under the data protection authority's list? How many of the nine European criteria does it meet? Conclusion (needed, not needed, update existing one) with one sentence explaining why.

Which sentence in your privacy notice are you updating?

Final checklist from the lesson: how many of the 11 points have you completed, and what's still missing?

What would you do differently next time you switch?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing