GDPR Article 30 record and AI: the line to copy
Last updated : 2026-10-11
One record line per purpose, with local pseudonymisation as the technical measure; the line template is below.
What Article 30 requires
Article 30(1) of the GDPR requires the controller to keep a written record, including in electronic form, containing: its identity and contact details, the purposes, the categories of data subjects and of personal data, the categories of recipients, transfers to a third country where applicable, the time limits for erasure and a general description of security measures (the last two “where possible”). The record must be made available to the supervisory authority on request.
Paragraph 5 exempts organisations with fewer than 250 employees, unless the processing is likely to result in a risk to the rights and freedoms of data subjects, is not occasional, or includes special categories of data (health, for example). A practice that regularly submits case files to an AI assistant may therefore be covered.
The French authority, the CNIL, publishes a simplified record template in ODS format. Its fields follow those of the article.
What you need to enter
Using ChatGPT or Claude on work documents is processing of personal data: the names, contact details and identifiers of the people mentioned in the text are sent to the model provider. One line per purpose is enough: “drafting letters”, “summarising files” and “preparing submissions” are three lines if their data or recipients differ.
The line template
Copy the table into your record, then complete every cell marked “To complete”. The other cells describe how ndaact.ai behaves; check them and adapt them to your actual use.
| Field | Suggested content |
|---|---|
| Name of the processing | Use of a redaction tool before sending to an LLM (ChatGPT, Claude) |
| Controller and contact (Art. 30(1)(a)) | To complete: name, contact details, DPO where applicable |
| Purpose (Art. 30(1)(b)) | Example to adapt: drafting, summarising or analysing professional documents with an AI assistant, replacing detected identifying data with markers before sending |
| Legal basis | To complete. Article 30(1) does not require this field, but your lawfulness analysis must exist elsewhere |
| Data subjects (Art. 30(1)(c)) | To complete for your activity: clients, patients, counterparties, staff, people named in documents |
| Categories of data (Art. 30(1)(c)) | Data contained in the submitted texts: identity, contact details, identifiers (French social security number, IBAN, company numbers), health data where relevant. Detected entities are replaced by markers before sending; an entity that is not detected is sent in clear text. To complete with your real categories |
| Recipients (Art. 30(1)(d)) | The provider of the model used (to be named), which receives the text with markers in place of the detected entities. The publisher of ndaact.ai does not receive the content of the texts |
| Transfers outside the EU (Art. 30(1)(e)) | To complete from your provider's contract and settings. Do not assume there is no transfer |
| Retention and erasure (Art. 30(1)(f)) | To complete. Provider side: period set by your account settings and its contract. Local side: the local audit log stays until you delete it |
| Security measures (Art. 30(1)(g)) | Local pseudonymisation with markers before sending, on the user's machine. Marker-to-value mapping kept in an encrypted local store (AES-256). In the extension, sending is blocked when protection is unavailable, unless the user turns it off deliberately. Local audit log chained by hash. Limit to state: detection can miss entities |
What the local audit log provides
The desktop app keeps a local, append-only log chained with SHA-256 hashes. For each operation it records the timestamp, the provider, the request status, the volumes exchanged, and, for each detected entity, its type and its position in the text. The app’s “Journal” screen shows the number of entities per category. The original value does not appear in it.
This log documents the technical measure in the last field: it shows that entities were detected and replaced, on which date and in which category.
What the log does not provide
- It does not contain the original values or the text of the prompts.
- It does not identify the person who ran the operation: it records the machine, with no user name.
- It does not prove that no entity stayed in clear text: it only lists what was detected.
- It does not replace the record. The record is a document you write and keep up to date; the log is a technical supporting item.
- At the date of this guide, the app has no button to export the audit log in a format ready for a DPO or an inspection.
Before you use the line
- Copy the table into your record, one line per purpose.
- Complete the “To complete” cells and check that the model provider is listed among the recipients.
- Have your DPO or an advisor review the line, in particular the legal basis and the transfers.
Source: GDPR, Article 30, Regulation (EU) 2016/679 of 27 April 2016; CNIL, “Le registre des activités de traitement”, 13 April 2018.
This page is a translation. The French version prevails.