risks of not maintaining a proper record of processing