If you're a company based outside the EU but you fall under the scope of the GDPR you will most likely need to have a record of processing...