What is a Record of Processing Activities?
Art. 30 GDPR requires every organization (with very limited exceptions) to maintain a written Record of Processing Activities — a structured register of all personal data processing operations carried out by or on behalf of the organization. It must be made available to the supervisory authority on request.
What must be included in the RoPA?
Each entry in the RoPA must document:
- Name and contact details of the controller
- Purpose of the processing (e.g., customer management, accounting)
- Categories of data subjects (e.g., customers, employees)
- Categories of personal data (e.g., name, email, banking details)
- Recipients of the data (internal and external, including processors)
- Third-country transfers (e.g., US cloud services)
- Retention periods for each data category
- Technical and organizational measures (TOMs)
Why a complete RoPA matters
The RoPA is not just a mandatory document — it is also the most important piece of evidence towards the supervisory authority. In a regulatory audit, it is the first thing that gets requested.
An incomplete or outdated RoPA is considered a data protection violation and can trigger fines of up to €10 million or 2% of global annual turnover.
Our process
- Workshop — jointly capturing all processing activities (approx. 2–4 hours)
- Drafting — we create the complete RoPA following the statutory template
- Review — verification and sign-off by you
- Handover — delivered as an editable document and PDF
- Maintenance — on request, we keep the RoPA continuously updated