One page, and then it stops moving
Who must keep one, what goes in it, and what the newsletter line looks like.
7 min read
It is the document nobody wants to write and everybody must be able to show. Good news: for a newsletter it fits on one page — and most of what goes in it can be supplied by your sending tool.
Who must keep one
GDPR Article 30 is explicit: the obligation applies to every controller and processor, of any size, as soon as it processes personal data of people in the European Union.
An exemption exists for organisations with fewer than 250 employees — but it only covers occasional processing, with no sensitive data and no risk to people. Managing customers, running payroll, sending a newsletter regularly are not occasional.
In other words: the exemption covers very particular cases, and when in doubt the guidance recommends recording the processing rather than leaving it out.
What goes in it
For each processing activity, eight items: the purpose — why the data is collected; the categories of people concerned; the categories of data; the recipients it is disclosed to; any transfers outside the European Union and the safeguards around them; the retention periods planned for each category; and a description of the security measures.
Nothing more. It is neither a report nor a policy: it is an inventory.
The newsletter line, in plain words
Purpose: sending a newsletter to people who signed up for it. People concerned: subscribers. Data: the email address, the first name if asked for, the date and origin of the signup, the history of opens and clicks.
Recipients: your emailing tool and, behind it, its host and its sending service — these are processors, and they get named. Transfers: none, if the tool and the sending stay in the European Union.
Retention: the length of the subscription, plus a reasonable period after unsubscribing — an unsubscribed address is kept precisely so that you never write to it again. Security: password access, limited members, encrypted connections.
What the register is not
What the register is not
It is not a declaration to a supervisory authority. Under the GDPR, prior declarations were replaced by the internal register requirement in 2018: the document stays with you, and supervisory authorities or complainants may ask to see it.
It is not a public document. It does not belong on your website — unlike your privacy policy, which is addressed to the people concerned.
What Plumail can give you to fill it in
The processors, named: data is hosted in Germany, at Hetzner, and sending goes out from Ireland. One thing leaves the European Union, and only if you ask for it: the text you entrust to the writing assistant, processed by Anthropic.
The data kept, listed: email address, the custom fields you created, the date and origin of the signup, status, opens and clicks. Your subscribers export to CSV from the settings, and a deleted address is genuinely deleted.
That fills the « recipients », « transfers » and « categories of data » lines of your register. The rest — the purpose, the retention periods you choose — is yours alone.
The register is not administrative punishment: it is the only way to know, a year later, what data you hold and why. For a newsletter it is written in an hour and then stops moving.
Words from this guide
The details your register asks for
Hosted in Germany, sent from Ireland, and your subscribers exportable to CSV. 3,000 emails a month, no credit card.