Records of processing activities are when you keep written documentation of the procedures you follow when processing data. Processing activities that must be documented include the categories of data processed, why the processing is happening, and who receives the data. The GDPR requires keeping records of processing activities for organizations with 250 or more employees.