Does the undertaking maintain a record of processing activities?

Record of processing activities: frequently asked, variably substantiated

Whether the enterprise maintains a record of processing activities varies by company and depends on the actual situation in the chain file: sometimes this is already established as an answer from an earlier questionnaire, sometimes the supporting document is still missing. This is a question that appears standard in questionnaires on privacy and data protection, usually in the same section as questions about processor agreements and data breaches. The customer asking this typically wants to know whether a document exists — not how complete it is.

If the answer is "yes", there should be a concrete supporting document: the record itself, or an excerpt from it containing the processing activities relevant to the relationship with that customer. If that document is missing, then "no" or "unknown" is the honest answer — claiming to have a record without the system finding one will raise more questions during a customer's spot check than a no will. This question often appears alongside the question whether the enterprise enters into processor agreements with its service providers, and the two answers must be mutually consistent: a record without processor agreements, or vice versa, stands out to anyone reviewing the list.

Why this question is not substantively derived from the CSRD

The source provided in this file is Directive (EU) 2022/2464 (CSRD), which concerns sustainability reporting and not a record of processing activities — that concept comes from the GDPR, not from the CSRD. There is therefore no article from this directive that serves as substantiation for this question; the answer must come from the enterprise's own chain file, not from this source. Anyone receiving this question together with other privacy questions often recognizes the same source as in the question about the enterprise's registered name: a fixed block of basic data that is requested by almost every customer portal, regardless of whether the underlying legislation actually applies to this enterprise.