The register of processing activities serves as a basis for evaluating the legitimacy of a processing activity under data protection law and for documenting compliance with applicable data protection law.