Reports

The GDPR's accountability principle (Article 5(2)) means you must be able to show you comply, not just say it. In practice that means a small set of records and reports, kept up to date and ready when a regulator, a customer or an auditor asks.

Records the law requires

• Records of processing activities (GDPR Article 30): each processing activity with its purpose, categories of people and data, recipients, transfers, retention and security measures. Organisations under 250 employees are exempt only if processing is occasional and low-risk, which rarely fits a website collecting orders or tracking visitors.
• Data protection impact assessments (Article 35): before processing likely to result in a high risk, with the risks and the measures that address them.
• Breach log (Article 33(5)): every personal data breach, its effects and what you did, including breaches you did not report.
• Data processing agreements (Article 28) and transfer safeguards for each third-party service.
• Consent records (Article 7(1)): proof of who consented to what, when and how, including cookie consent.

Records that make life easier

• A log of rights requests with dates and answers.
• An accessibility statement and the test results behind it.
• A register of licensed assets.
• Review verification procedures (see Fake Reviews).
• Security test results, patch history and incident reports (see Security).

What a good compliance report contains

1. Scope: which websites, apps and processes were checked, and when.
2. Findings: each issue, the rule it relates to, where it was found, with evidence such as a screenshot or a request log.
3. Risk: how serious each finding is for the people affected and for the business.
4. Actions: the fix, an owner and a deadline, in priority order.
5. Follow-up: the date each fix was verified, so the next report shows progress.

This guide is general information about EU rules, not legal advice. Requirements can differ by country and by business: check with your data protection authority or a lawyer for your case.