--- title: "Records of Processing Activities (RoPA) | Pitch" description: "What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful." url: https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Privacy & Data Protection](https://www.pitch.law/academy/topics/privacy) # Records of Processing Activities (RoPA) What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful. - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework Article 30 GDPR requires controllers and processors to keep a written record of their processing activities, including in electronic form. The record is internal. It is not published, but it must be made available to the supervisory authority on request (Article 30(4)), which is the national data protection authority. A controller's record contains, for each processing activity (Article 30(1)): - the name and contact details of the controller, any joint controller, the controller's representative and the Data Protection Officer; - the purposes of the processing; - the categories of data subjects and of personal data; - the categories of recipients, including those in third countries; - transfers to third countries or international organisations and, for certain transfers, the documented safeguards; - where possible, the envisaged time limits for erasure of the different categories of data; - where possible, a general description of the technical and organisational security measures. A processor keeps its own record under Article 30(2): the processors and controllers on whose behalf it acts, the categories of processing carried out for each controller, transfers, and a general description of security measures. ### Who must keep one Article 30(5) exempts enterprises or organisations with fewer than 250 employees, but the exemption does not apply if the processing is likely to result in a risk to the rights and freedoms of individuals, if the processing is not occasional, or if it includes special categories of data or data about criminal convictions. Employee payroll, customer administration and a standing mailing list are not occasional. In practice nearly every organisation that processes personal data on a regular basis must keep a record, whatever its size. ### What the record is for The record is one of the main ways to show accountability under Article 5(2). It is also the basis of other duties: the information you give under Articles 13 and 14, the response to access requests, the choice of retention periods, the selection of processors, and the identification of processing that needs a DPIA. ## In practice A software company in Ghent with 40 employees sells a subscription product to business customers. It processes personal data in at least two roles. As controller it processes employee data, applicant data, contact data of customer representatives and website visitor data. As processor it hosts its customers' end-user data. It therefore keeps two records: a controller record with perhaps ten to fifteen activities (payroll, recruitment, CRM, marketing email, website analytics, supplier management), and a processor record listing each customer for whom it processes data. For website analytics, the entry states the purpose (understanding use of the site), the categories (device and usage data of visitors), the recipient (the analytics provider), the transfer position (does the provider store data outside the EEA, and on what basis), the retention period (for instance fourteen months of raw data) and the security measures. The entry also points to the processing agreement with the provider, which is why the register and your [data processing agreements](https://www.pitch.law/solutions/data-processing-agreements) should be maintained together. Typical weaknesses are a register written once and never updated, entries that describe a department rather than a purpose, no retention period ("as long as necessary"), and processors that are missing. The authority will read an incomplete record as a sign that the underlying processing is not under control. ### Keeping it current The practical answer is ownership: a named person per processing activity who confirms the entry at least once a year and whenever a new tool or purpose is introduced. [Our register function](https://www.pitch.law/technologies/privacy-register) keeps entries in a shared record that your team edits and the DPO approves, and the [DPIA function](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) starts from the register entry when an activity is high-risk. ## Frequently asked questions ### Is the record of processing the same as a privacy notice? No. The privacy notice informs individuals under Articles 13 and 14. The record is an internal document for accountability and for the authority. The two must be consistent. ### Does a small business with ten employees need a register? Usually yes. The 250-employee exemption is lost as soon as processing is not occasional or involves risk or special categories, which covers payroll and customer records. ### Must we record every system? The record is organised by processing activity, not by system. One activity may use several systems, and one system may serve several activities. ### Can the authority fine us for not having a record? Yes. A failure to keep a record falls under Article 83(4)(a), which allows fines of up to EUR 10 million or 2% of worldwide annual turnover. In practice, the absence of a record usually comes up as part of a wider investigation. ## How this connects A well-kept register is the base of [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) and the starting point when you draft or review [processing agreements](https://www.pitch.law/solutions/data-processing-agreements). Retention periods are covered in [how long you may keep personal data](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data), and transfers in [international data transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii). ## In short - What Article 30 GDPR requires you to record - Who must keep a register, whatever their size - How to keep entries current ## Related solutions - [Solutions](https://www.pitch.law/solutions/dpo-as-a-service) ### [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) - [Solutions](https://www.pitch.law/solutions/data-processing-agreements) ### [Data Processing Agreements](https://www.pitch.law/solutions/data-processing-agreements) [Article 28 GDPR agreements drafted, reviewed and negotiated for controllers and processors, including sub-processors and international transfers.](https://www.pitch.law/solutions/data-processing-agreements) ## Technology we use - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) - [Technology](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) - [Technology](https://www.pitch.law/technologies/contract-studio) ### [Document Studio](https://www.pitch.law/technologies/contract-studio) [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://www.pitch.law/technologies/contract-studio) - [Technology](https://www.pitch.law/technologies/breach-response-workflow) ### [Data Breach Handling](https://www.pitch.law/technologies/breach-response-workflow) [A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer.](https://www.pitch.law/technologies/breach-response-workflow) ## More in Privacy & Data Protection - ### [Cookies and Consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management) [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://www.pitch.law/academy/cookie-compliance-and-consent-management) - ### [Data Breaches: the 72-Hour Rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) [When a personal data breach must be notified to the data protection authority and to individuals, how the 72 hours are counted and what to document.](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) - ### [How Long May You Keep Personal Data?](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) [The storage limitation principle in Article 5(1)(e) GDPR, how to set retention periods and how to delete in practice.](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) - ### [Data Subject Access Requests](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) [How the right of access works under Article 15 GDPR, how to handle the deadline, what you may refuse and what a good response contains.](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) - ### [International Data Transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) [How Chapter V GDPR works after Schrems II: adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses and the assessment that goes with them.](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) - ### [Website Technology Audits and the GDPR](https://www.pitch.law/academy/website-technology-audits-and-gdpr) [What a website technology audit examines, why privacy notices and actual data flows drift apart, and which legal duties it checks.](https://www.pitch.law/academy/website-technology-audits-and-gdpr) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)