Processing register and data processing agreements
How the record of processing activities is maintained, which contracts are needed and how you check acceptance by organizations.
PrivacyBasic (free)Checked on 30.10.2026
Prerequisites
- You are responsible for data protection (role “Privacy and compliance” or operator management).
Who may do this?
Operator process. The register is maintained centrally in the source code and loaded into the database; the “Privacy” role carries the “processing register” right for this (enforcement on existing endpoints is not switched over yet). All documents are drafts and must be reviewed before go-live.
Step by step
Know the required fields
Per entry: name and purpose, categories of data subjects and data, recipients, third-country transfers (target: none), retention periods, safeguards, legal basis and impact assessment.
Maintain the register
Whoever builds a feature with new personal data adds the entry in the same piece of work. The register is then loaded repeatably and can be exported.
Clarify roles
Decide whether the operator is a processor or joint controller for club data. Recommendation (to be reviewed): processor of the club for club data, controller for account and platform.
Conclude contracts
Hosting, object storage, email delivery and backup each need a contract under Art. 28 GDPR, plus the list of sub-processors in the privacy policy. For every new provider that receives personal data, the overview and contract proof are maintained first.
Check acceptance by organizations
Organizations accept the data processing agreement in the application (when founding, taking over, municipality request). In platform moderation a card “Acceptance of the current version … by the organizations” shows “{n} of {m} accepted” and “{n} without acceptance”.
Common errors and solutions
- New version of the agreement: organizations have not accepted.
- The task “Accept DPA” appears for leadership; without acceptance of the current version the entry stays “without acceptance” in the overview.
- An entry in the register is marked “open”.
- Processors, role allocation, retention of bookings and the legal basis of dues administration are still to be clarified.
Good to know
- The data protection officer and contact belong in the legal notice. The document does not replace legal advice.
- Signed contracts are stored outside this public area; there is an overview of data processors that must be maintained before a new service is used.