5. Record of processing activity

Article 30 of Regulation (EU) 2016/679 establishes that the data controller will keep a record of the processing activities carried out under his responsibility. Said record must contain all the information indicated below:

the name and contact details of the controller and, where applicable, the co-controller, the representative of the controller, and the data protection officer;
the purpose of the data processing;
a description of the categories of data subjects and the categories of personal data;
the categories of recipients to whom the personal data were or will be communicated, including recipients in third countries or international organisations;
where applicable, transfers of personal data to a third country or an international organization, including the identification of said third country or international organization and, in the case of transfers referred to in Article 49(1), second subparagraph, the documentation of adequate guarantees;
where possible, the deadlines for deletion of the different categories of data;
where possible, a general description of the technical and organizational security measures referred to in Article 32(1).

In addition, Public Administrations must make public the inventory of their processing activities, being accessible by electronic means, as established in article 31.2 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights.

In application of the above, the personal data processing activities carried out by the Tax Agency are listed below.