Definition
The Record of Processing Activities (RAT, GDPR art. 30) is the internal inventory where the controller lists every personal-data processing activity. For each activity it must include: name and contact of the controller (and DPO if applicable), purpose, categories of data subjects and data, recipients (third parties to whom data is shared), international transfers if any, retention periods and a description of technical and organisational security measures.
The RAT is not published — it is internal documentation shown to the AEPD on request. It can be kept as a spreadsheet, Word doc or specialised tool. The key is to keep it current and reflective of the club's reality.
When does it apply?
Mandatory for every controller, with no practical minimum threshold (the art. 30.5 exception is very narrow and rarely applies to clubs). Create the RAT at incorporation and review it at least yearly or whenever something changes (new software, new sport section, change of accountant).
Practical example
Common mistakes
- Thinking a small club doesn't need one: the art. 30.5 exception is very restrictive.
- Listing only 2-3 activities: most clubs have 6-10 distinct activities.
- Not updating after changes: every new software or comms channel is a new activity or processor.
- Confusing the RAT with the privacy policy: the RAT is internal; the policy is public.
Related terms
If you care about this term, you probably also wonder about these:
Go deeper
This is not specific legal or tax advice
Information as of May 2026. Regulation evolves and every club has its own casuistry (region, federation, size, activities). For your specific case talk to a lawyer or tax advisor specialised in Spanish sports law.