GDPR Record of Processing Activities (RoPA): What Article 30 Requires

What a controller's record must contain

Under Article 30(1) GDPR, each controller must keep a record of the processing activities under its responsibility, with:

The legal basis is not on the list, but record it anyway: you need it for your privacy notice (Article 13(1)(c)) and to show accountability. Most templates include it.

What a processor's record must contain

If you process data on behalf of customers, for example as a SaaS provider, Article 30(2) requires a record of all categories of processing you carry out for each controller:

• your name and contact details, those of each controller you act for, any representatives and your data protection officer;
• the categories of processing carried out on behalf of each controller;
• transfers to third countries or international organisations, with the same documentation as above;
• where possible, a general description of your security measures.

Many companies are both: a controller for their own staff and customers, and a processor for the data in their product. They need both records.

Format and access

The record must be in writing, which includes electronic form (Article 30(3)), and you must make it available to the supervisory authority on request (Article 30(4)). A spreadsheet is fine if it is complete and current.

Are you exempt? Probably not

Article 30(5) exempts enterprises and organisations with fewer than 250 employees, but only if none of these applies:

• the processing is likely to result in a risk to the rights and freedoms of data subjects;
• the processing is not occasional;
• the processing includes special categories of data (Article 9(1)) or data on criminal convictions and offences (Article 10).

Payroll, customer accounts and marketing lists are processed continuously, so they are not occasional. That is why the EDPB has endorsed the reading that small organisations must keep records at least for those types of processing; in practice almost every business needs a RoPA for its core activities.

A reform is pending: as part of its fourth simplification omnibus, the European Commission proposed in 2025 to extend the exemption to organisations with fewer than 750 employees, unless the processing is likely to result in a high risk. The EDPB and EDPS commented on it in July 2025. It is a proposal, not law: Article 30(5) applies as written until a change is adopted and in force.

How to build a RoPA that stays current

1. List processing activities, not systems. "Payroll", "customer support", "newsletter" and "recruitment" are activities; one system can serve several, and one activity can use several systems.
2. Start from what you pay for. Your SaaS subscriptions and contracts reveal most activities and recipients quickly.
3. Fill the Article 30 fields per activity, plus the legal basis, the systems used and an owner.
4. Add retention periods you actually apply, or the criteria for them.
5. Mark transfers outside the EEA and the safeguard used, such as an adequacy decision or Standard Contractual Clauses.
6. Link it to your other documents: the privacy notice, DPIAs and processor contracts should match the record.
7. Review it on change: a new tool, purpose, provider or country. Put a review date on it and check it at least once a year.

Map it first: the free Data Mapping Tool helps you list your data flows, and the Privacy Policy Generator turns the result into a draft notice.

Skip the blank spreadsheet. The GDPR Records of Processing (RoPA) Kit includes controller and processor RoPA templates, a data inventory workbook, a completion guide, a legitimate interest assessment and a consent record template.

Sources

• Regulation (EU) 2016/679 (GDPR), Articles 9, 10, 13 and 30, EUR-Lex
• EDPB: Position paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR
• EDPB: EDPB and EDPS welcome simplification of record keeping obligations and request further clarifications (9 July 2025)

Related tools