It is a record of an organization’s processing of personal data that GDPR requires controllers, and in some cases processors, to keep. The record sets out, among other things, the purposes, the categories of data, and the legal basis.