Scenario: PickFood is an online food delivery service that allows customers to order food online and pay by credit card. The payment service is provided by PaySmart, which processes the transactions. Questio n: According to Article 30 of GDPR, what type of information should PaySmart NOT maintain when recording online transaction processing activity?

Article 30 of the GDPR requires controllers and processors to maintain a Record of Processing Activities (RoPA). This record is a high-level, meta-document that describes data processing operations. It mandates the inclusion of categories of personal data being processed, not the actual personal data itself. Including a detailed list of every customer's transaction amount and purchased items would be a misinterpretation of Article 30. Such a practice would turn the record into a duplicate database of the processed information, which is not its purpose and would violate the principle of data minimization concerning the record itself.

A. This is incorrect. Article 30(2)(d) explicitly requires a processor's record to contain, where possible, "a general description of the technical and organisational security measures referred to in Article 32(1)."
B. This is incorrect. While the processor (PaySmart) is not required to list erasure periods in its own Article 30 record (this is an obligation for the controller under Art. 30(1)(f)), option D is more fundamentally wrong as it confuses the record about processing with the actual data being processed.
C. This is incorrect. Information about data transfers falls under the requirements of Article 30(2)(b) "the categories of processing carried out on behalf of each controller" and, if applicable, Article 30(2)(c) regarding transfers to a third country.

1. General Data Protection Regulation (EU) 2016/679, Article 30, Paragraph 2:

"Each processor...shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: ... (b) the categories of processing carried out on behalf of each controller; ... (d) where possible, a general description of the technical and organisational security measures..."

This directly supports that A and C are required elements (or categories of elements) and shows that the record is about "categories," not specific instances of data as suggested in D.

2. University of Edinburgh, "Records of Processing Activities under the UK GDPR":

"The record must be a high-level overview of the processing... It is not about listing every single piece of personal data you hold, but the categories of personal data you process..."

This academic guidance clarifies the intent of Article 30, explicitly stating that the record is a high-level overview and should contain categories of data, not the data itself, which directly refutes option D.

3. University of Cambridge, Information Compliance Office, "What are records of processing activities?":

"The record is a separate, high-level document that provides an overview of your processing of personal data... It is not your existing privacy notices, data inventories or data flow maps, although you can use these to help you create the record."

This source reinforces that the RoPA is a distinct, high-level document, separate from the actual data inventories, making option D an incorrect type of information for inclusion.