1.

Member States shall provide for controllers to maintain a record of all categories of processing activities under their responsibility. That record shall contain all of the following information: the name and contact details of the controller and, where applicable, the joint controller and the data protection officer; the purposes of the processing; the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations; a description of the categories of data subject and of the categories of personal data; where applicable, the use of profiling; where applicable, the categories of transfers of personal data to a third country or an international organisation; an indication of the legal basis for the processing operation, including transfers, for which the personal data are intended; where possible, the envisaged time limits for erasure of the different categories of personal data; where possible, a general description of the technical and organisational security measures referred to in Article 29(1).

← Article 24 · All articles · art_24__para_1__text_1 →

Source: EUR-Lex (Cellar) · retrieved 2026-09-25 · Text as adopted (Official Journal); later amendments are not incorporated in this text.