Records of processing: the artefact every privacy obligation leans on

What personal data you hold, the purposes it is processed for, the categories of data subject, who it is shared with including sub-processors, any transfers outside the country, retention periods, and a description of the security measures applied.

The work is rarely the document — it is the discovery. Personal data accumulates in support tools, analytics, log files, spreadsheets and backups, and the first honest inventory is usually a surprise. That is exactly why it precedes the notice, the consent mechanics and the rights process, all of which depend on knowing what you actually hold.