What must a record of processing activities contain?

In brief

A record of processing activities, often called a record of processing activities (RoPA), is the organisation’s written map of personal data processing. Under the General Data Protection Regulation (GDPR), the controller keeps a record of processing under its responsibility, and the processor keeps a separate record of processing done for controllers. The record must show, among other things, the purposes of processing, the groups of data subjects and personal data, the recipient groups, international transfers, deletion time limits where possible, and a general description of security measures. It is not a one-off spreadsheet: the GDPR’s Article 24 requires relevant measures to be reviewed and updated where necessary.

The record shows where personal data is processed and why

Personal data is data about a person in work systems. A customer account, an employee file and an access log are everyday examples.

The record of processing activities answers a practical management question: where does the organisation process personal data, for what purpose, and under whose responsibility?

The GDPR’s Article 30 is the main rule. It requires each controller to maintain a record of processing activities under its responsibility. A controller is the organisation that decides why and how personal data is processed. For example, an employer is normally the controller for its employee administration.

The same article also requires each processor to maintain its own record. A processor is an organisation that processes personal data for a controller. A payroll service provider or cloud service provider may be a processor when it acts on documented instructions from the controller.

The record supports accountability. The GDPR’s Article 5(2) says the controller is responsible for compliance with the data protection principles and must be able to show it. The record is one of the places where that proof starts. It connects purposes, data categories, recipients, deletion timing and security measures in one view.

The record is not the same as the privacy notice. A privacy notice is information given to the data subject under the GDPR’s Articles 12, 13 and 14. The record is an internal accountability document that must be available to the supervisory authority on request. The two documents should not contradict each other, but they have different audiences.

For the legal basis question behind each purpose, see What legal basis permits processing personal data?. For the wider role split between controller and processor, see Controller or processor: when a data processing agreement is needed and what Article 28 requires.

The controller’s record must contain these details

The controller’s record is about processing activities under the controller’s responsibility. The GDPR’s Article 30 lists the required content.

A usable controller record contains at least these fields:

Field in the controller’s record	What it means at work
Name and contact details	The controller, any joint controller, any controller representative and the data protection officer where applicable.
Purposes of processing	The reason for processing, such as handling a service request or administering an employment relationship.
Groups of data subjects	The groups of people whose data is processed, such as customers, employees or users.
Groups of personal data	The types of data, such as contact details, contract data or use logs.
Groups of recipients	The groups that have received or will receive the data, including recipients in third countries or international organisations.
International transfers	Where relevant, the transfer to a third country or international organisation, the country or organisation, and the documents on safeguards where Article 30 requires them.
Planned deletion time limits	Where possible, the planned time limits for deleting different data groups.
General security description	Where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

The record should describe activities, not every single document. An activity could be customer support, recruitment, invoicing or user account management. The level must still be useful. If one line says only “administration”, it will not show why the data is processed, who receives it, or how long it is kept.

Joint controllership matters. The GDPR’s Article 26 applies where two or more controllers jointly determine the purposes and means of processing. Article 30 then requires the controller record to include the possible joint controller’s name and contact details. This helps show who is responsible for which part of the processing.

International transfers need special attention. The GDPR’s Article 44 says transfers to a third country or international organisation are allowed only under the conditions in the GDPR’s transfer chapter. Article 30 therefore asks the record to show relevant transfer information. If Article 49(1), second subparagraph, is used, Article 49(6) also requires the assessment and safeguards to be documented in the Article 30 record.

The processor has its own record

The processor’s record is different because the processor does not decide the controller’s purposes. It records what the processor does on behalf of controllers.

Under the GDPR’s Article 30, the processor record must include:

• the name and contact details of the processor or processors;
• the name and contact details of each controller on whose behalf the processor acts;
• the name and contact details of the controller’s or processor’s representative where applicable;
• the name and contact details of the data protection officer where applicable;
• the categories of processing carried out for each controller;
• relevant details of transfers to a third country or international organisation;
• where possible, a general description of technical and organisational security measures.

The processor’s record should match the processor contract in the main points. The GDPR’s Article 28 requires a contract or other legal act for processor processing. That contract sets out matters such as the subject and duration of processing, its nature and purpose, the type of personal data and the categories of data subjects. If the record and the contract describe different processing, the organisation has a governance problem to fix.

The processor also has a duty to help the controller in several areas under Article 28. This includes help with data subject rights and with the duties in GDPR Articles 32 to 36, taking into account the nature of processing and the information available to the processor. A clear processor record makes that help easier because it shows what the processor actually does.

The record must be available to the supervisory authority

The GDPR’s Article 30 requires the record to be in writing, including electronic form. A spreadsheet, register tool or governance system can therefore be enough if it contains the required information and can be produced when needed.

The same article requires the controller or processor, and where applicable its representative, to make the record available to the supervisory authority on request. The record is therefore not only an internal planning aid. It is also evidence.

This connects with the controller’s broader duty under the GDPR’s Article 24. The controller must implement appropriate technical and organisational measures to ensure and show that processing complies with the GDPR. Those measures must be reviewed and updated where necessary.

The record also helps when something goes wrong. The GDPR’s Article 33 sets a notification duty for a personal data breach to the supervisory authority unless the breach is unlikely to create a risk to people’s rights and freedoms. The controller must document personal data breaches under Article 33(5). A current record helps identify affected data groups, data subjects, recipients and security measures. For breach timing, see Personal data breach: the 72 hours start when an employee notices.

The under 250 employee exception does not always remove the duty

The GDPR’s Article 30 contains an exception for an enterprise or organisation with fewer than 250 employees. The exception does not apply if any of the listed conditions is met.

The duty still applies if:

• the processing is likely to result in a risk to the rights and freedoms of data subjects;
• the processing is not occasional;
• the processing includes special categories of personal data referred to in Article 9(1);
• the processing includes personal data relating to criminal convictions or offences referred to in Article 10.

This means employee count is not the only question. A small organisation can still need a record because its processing is regular, risky, or concerns sensitive types of data. A small controller should therefore test the exception against the actual processing activities, not only against headcount.

The exception also does not remove other duties. The GDPR’s Article 5(2) accountability rule still applies to controllers. Articles 12 to 14 still govern information to data subjects. Article 28 still governs processor use. Article 35 still governs a data protection impact assessment where processing is likely to create a high risk.

Keeping it up to date starts with spotting change

The GDPR does not set a fixed calendar interval for updating the record. It uses a different logic. Article 30 requires the record to be maintained, and Article 24 requires the controller’s measures to be reviewed and updated where necessary.

A practical update trigger is any change that affects an Article 30 field. The record should be reviewed when:

• a new processing purpose is added;
• an existing purpose changes;
• new groups of data subjects are included;
• new groups of personal data are collected or created;
• a new recipient group receives the data;
• personal data is transferred to a third country or international organisation;
• deletion time limits change;
• technical or organisational security measures change in a material way;
• the controller, joint controller, representative or data protection officer contact details change.

A data protection impact assessment, or data protection impact assessment (DPIA), can create another update need. Under the GDPR’s Article 35, a DPIA is required before processing that is likely to create a high risk to natural persons’ rights and freedoms. Article 35 also requires a review where necessary to assess whether processing is performed in line with the DPIA, at least when the risk changes. If the DPIA changes the description of processing, safeguards or risk controls, the record should be checked against it. For the assessment itself, see Data protection impact assessment: when a DPIA is mandatory and what goes into it.

A data protection officer can support this process. The GDPR’s Article 38 requires the data protection officer to be involved properly and in good time in all issues relating to personal data protection. Article 39 gives the data protection officer tasks that include informing and advising the controller or processor and employees, monitoring compliance, advising on DPIAs when asked, and cooperating with the supervisory authority.

The record defines responsibility, but it does not solve everything

The record is a map. It is not a legal basis, a privacy notice, a processor contract, a breach report or a data protection impact assessment.

It does not by itself make processing lawful. The purpose in the record must still have a legal basis. The data subject must still receive the information required by the GDPR’s Articles 12, 13 and 14 where those articles apply. The controller must still respect data subject rights under Articles 15 to 22.

It does not replace a processor contract. If another organisation processes personal data for the controller, the GDPR’s Article 28 requires a contract or other legal act with the Article 28 content. The record should align with that contract, but it is not the contract.

It does not replace a DPIA. If processing is likely to create a high risk, the GDPR’s Article 35 requires an assessment before the processing. The record can help describe processing, but the DPIA also assesses necessity, proportionality, risks and measures.

It also does not replace AI-specific assessment duties. For some deployers of high-risk artificial intelligence systems, the AI Act’s Article 27 requires a fundamental rights impact assessment before first use. If duties have already been fulfilled through a GDPR DPIA, Article 27 says the fundamental rights impact assessment supplements that DPIA. For the AI side, see High-risk AI duties.

The honest limit is important. A record that is complete on paper but disconnected from real systems gives weak evidence. A record that changes when the work changes gives management, the data protection officer and the supervisory authority a clearer view of what is actually happening.