The CNIL (French data protection authority) has published a model for the records which data controllers and processors are required to keep under the General Data Protection Regulation (GDPR). Data controllers and processors will need to maintain a record of their data processing activities when the GDPR comes into force in May 2018, and the CNIL’s model provides a form that controllers and processors can use for this purpose.