Record of personal data processing activities under the responsibility of a controller or processor. Article 30 of the GDPR defines its content and provides for exceptions that must be assessed on a case-by-case basis.