Understanding GDPR Article 30 Records (ROPA)

What Is a Record of Processing Activities?

A Record of Processing Activities (ROPA) is a documented inventory of all personal data processing your organisation carries out. GDPR Article 30 makes maintaining a ROPA a legal obligation for most organisations and it is the first document supervisory authorities request during an audit.

Who Must Maintain a ROPA?

Article 30(5) provides a limited exemption for organisations with fewer than 250 employees, but only if their processing does not pose a risk to individuals, is not carried out regularly, or does not involve special category data. In practice, most businesses processing employee or customer data must maintain a ROPA regardless of size.

Mandatory Fields for Controllers (Article 30(1))

1. Name and contact details of controller and joint controllers
2. Name and contact details of the DPO
3. Purposes of processing
4. Categories of data subjects
5. Categories of personal data
6. Categories of recipients
7. Details of international transfers and safeguards used
8. Retention periods or criteria for determining them
9. General description of technical and organisational security measures

Keeping the ROPA Current

A ROPA is a living document. Trigger a review whenever a new vendor is onboarded, a new product feature collects data, a processing purpose changes, or a data subject category is added. Quarterly full reviews are best practice.

RINS.ai ROPA Module

RINS.ai automatically populates ROPA entries from scanned DPAs and contracts, flags missing mandatory fields, and exports regulator-ready spreadsheets and PDFs. Your ROPA stays current without manual effort.