Records of Processing Activities (ROPA)

A comprehensive template to document your processing activities in compliance with Article 30 of the UK GDPR.

Article 30 Requirements

Under Article 30 of the UK GDPR, controllers must maintain records of processing activities. This is mandatory for organisations with 250+ employees, but also applies to smaller organisations if processing:

1

Controller Details

Joint Controllers

If you are a joint controller with another organisation, record their details below.

2

Data Protection Officer

When is a DPO Required?

A DPO must be appointed if you are a public authority, your core activities involve large-scale systematic monitoring, or your core activities involve large-scale processing of special category data.

3

Processing Activities Register

Document each processing activity separately. Copy this section for additional activities.

Processing Activity

Entry 1

Article 30(1)(b) — List all purposes for this processing activity

Article 30(1)(c) — Describe the categories of individuals

Article 30(1)(c) — Mark special category data with ⚠️

Article 30(1)(d) — Include internal and external recipients

Article 30(1)(e) — Document third country transfers

Article 30(1)(f)

Article 30(1)(g) — General description of security measures

Processing Activity

Entry 2

Print additional copies of this page to document more processing activities

4

Review and Maintenance

Keeping Your ROPA Up to Date

  • Review at least annually or when significant changes occur
  • Update when new processing activities are introduced
  • Update when processors or recipients change
  • Update retention periods and security measures as needed
5

Approval and Sign-off

ICO Inspection

You must make this ROPA available to the ICO on request. Failure to maintain adequate records is a breach of Article 30 and may result in enforcement action.

Useful Links