Records of Processing Activities (RoPA)

The legal framework

Article 30 GDPR requires controllers and processors to keep a written record of their processing activities, including in electronic form. The record is internal. It is not published, but it must be made available to the supervisory authority on request (Article 30(4)), which is the national data protection authority.

A controller's record contains, for each processing activity (Article 30(1)):

• the name and contact details of the controller, any joint controller, the controller's representative and the Data Protection Officer;
• the purposes of the processing;
• the categories of data subjects and of personal data;
• the categories of recipients, including those in third countries;
• transfers to third countries or international organisations and, for certain transfers, the documented safeguards;
• where possible, the envisaged time limits for erasure of the different categories of data;
• where possible, a general description of the technical and organisational security measures.

A processor keeps its own record under Article 30(2): the processors and controllers on whose behalf it acts, the categories of processing carried out for each controller, transfers, and a general description of security measures.

Who must keep one

Article 30(5) exempts enterprises or organisations with fewer than 250 employees, but the exemption does not apply if the processing is likely to result in a risk to the rights and freedoms of individuals, if the processing is not occasional, or if it includes special categories of data or data about criminal convictions. Employee payroll, customer administration and a standing mailing list are not occasional. In practice nearly every organisation that processes personal data on a regular basis must keep a record, whatever its size.

What the record is for

The record is one of the main ways to show accountability under Article 5(2). It is also the basis of other duties: the information you give under Articles 13 and 14, the response to access requests, the choice of retention periods, the selection of processors, and the identification of processing that needs a DPIA.

In practice

A software company in Ghent with 40 employees sells a subscription product to business customers. It processes personal data in at least two roles. As controller it processes employee data, applicant data, contact data of customer representatives and website visitor data. As processor it hosts its customers' end-user data. It therefore keeps two records: a controller record with perhaps ten to fifteen activities (payroll, recruitment, CRM, marketing email, website analytics, supplier management), and a processor record listing each customer for whom it processes data.

For website analytics, the entry states the purpose (understanding use of the site), the categories (device and usage data of visitors), the recipient (the analytics provider), the transfer position (does the provider store data outside the EEA, and on what basis), the retention period (for instance fourteen months of raw data) and the security measures. The entry also points to the processing agreement with the provider, which is why the register and your data processing agreements should be maintained together.

Typical weaknesses are a register written once and never updated, entries that describe a department rather than a purpose, no retention period ("as long as necessary"), and processors that are missing. The authority will read an incomplete record as a sign that the underlying processing is not under control.

Keeping it current

The practical answer is ownership: a named person per processing activity who confirms the entry at least once a year and whenever a new tool or purpose is introduced. Our register function keeps entries in a shared record that your team edits and the DPO approves, and the DPIA function starts from the register entry when an activity is high-risk.

Frequently asked questions

Is the record of processing the same as a privacy notice?

No. The privacy notice informs individuals under Articles 13 and 14. The record is an internal document for accountability and for the authority. The two must be consistent.

Does a small business with ten employees need a register?

Usually yes. The 250-employee exemption is lost as soon as processing is not occasional or involves risk or special categories, which covers payroll and customer records.

Must we record every system?

The record is organised by processing activity, not by system. One activity may use several systems, and one system may serve several activities.

Can the authority fine us for not having a record?

Yes. A failure to keep a record falls under Article 83(4)(a), which allows fines of up to EUR 10 million or 2% of worldwide annual turnover. In practice, the absence of a record usually comes up as part of a wider investigation.

How this connects

A well-kept register is the base of DPO as a Service and the starting point when you draft or review processing agreements. Retention periods are covered in how long you may keep personal data, and transfers in international data transfers.