GDPR Article 30 - Records of processing activities

Article 30(2) is the audit-trail requirement and it is more specific than HIPAA's: each PROCESSOR must maintain a record of all categories of processing on behalf of each controller, including transfers to third countries with the identification of that country and the documentation of safeguards, plus 'where possible' the envisaged erasure time limits per data category. Article 30(5) exempts organisations under 250 employees only where processing is not occasional, carries no risk, and touches no Article 9 special-category or Article 10 data - a chatbot handling health data is none of those exceptions.