Record of Processing Activities
A free, editable Word record of processing activities for law firms in England & Wales. The small-organisation exemption does not reach a firm that handles matter files with health, family or criminal information every day, so every firm keeps this record. Six worked entries cover acting for clients, identity checks, billing and client money, employment, marketing and complaints, each with the seven items Article 30 names.
What's inside
A complete, UK-drafted record of processing activities
- The controller, the data protection contact, the DPO where there is one, and the ICO registration
- Six worked processing entries: matters, anti-money-laundering checks, billing and client money, employment, marketing, and complaints
- For each entry the purpose, lawful basis, data subjects, data, recipients, transfers, retention and security
- Special category and criminal offence data, and where the appropriate policy document sits
- Processors under Article 28 contracts, listed with what each holds and where
- A general description of security measures, and breach reporting
- Transfers outside the United Kingdom and the safeguard relied on
- Retention and erasure, including the copies held in connected Microsoft services
- An annual review with a dated log
How it works
- 1
Tell us where to send it
Enter your name, work email and organisation. We email you an editable Microsoft Word (.docx) file, personalised with your name.
- 2
Fill in the bracketed fields
Open it in Word, Google Docs or LibreOffice and complete every [bracketed] field with your details and commercial terms.
- 3
Review and adapt before use
Adapt the clauses to your circumstances and have it reviewed by a qualified solicitor before you sign or publish it.
This template is not legal advice. Writford is a software company, not a law firm, and is not regulated by the SRA. This document is a starting point that must be reviewed, adapted and approved by a qualified solicitor before use. It was last reviewed on 6 September 2026.
Get the free template
We email you an editable Word copy, personalised with your name. No account needed.
Looking for something else? Browse all templates.
Does a small law firm have to keep a record of processing activities?
Yes. The exemption for organisations with fewer than 250 employees falls away where processing is not occasional, is likely to put individuals at risk, or includes special category or criminal offence data. A law firm processes matter files all day and handles health, family and criminal information as a matter of course, so the exemption does not reach it and the record must be kept in writing and shown to the Information Commissioner on request.
- What has to be in it?
- Seven things for each processing activity: who the controller is and how to contact them, the purpose, the categories of people and of data, who receives the data, any transfer outside the United Kingdom and the safeguard, how long the data is kept, and a general description of the security measures. The template carries all seven against each entry.
- Is this the same as a privacy notice?
- No. The privacy notice tells clients and others what you do with their data. The record of processing activities is the internal register that the notice is written from, and it goes into more detail than a notice would: lawful bases, processors, and the retention period for each activity.
- Why worked entries rather than a blank table?
- Because a blank table is the document that never gets completed. Most law firms carry out the same six kinds of processing, so the template writes each of them out and asks you to correct the detail, which is quicker and produces a record that describes a real firm.
- How often should it be reviewed?
- At least once a year, and whenever something changes: a new processor, a new kind of work, a change in where data is held, or a new retention period. The template dates each review in a log so the record can show it was kept up to date.
- What about data in Outlook and OneDrive?
- Copies of matter material in connected email, calendar and file services are the firm's data too. The record says where they sit and that they are deleted separately in those services when a file is destroyed, because deleting the copy inside a practice system does not remove the original.