A record of processing activities (ROPA) is the inventory of the personal data an organisation processes: for each activity, the purpose, lawful basis, categories of data and data subjects, recipients, international transfers, retention and security measures. GDPR Art. 30 requires it from controllers and processors, and Brazil’s LGPD has a similar duty (Art. 37). It underpins DPIAs, data subject requests and regulator inquiries.
How to use
- Enter the organisation, its role (controller or processor) and the DPO contact channel.
- Add one row per processing activity, with purpose, lawful basis and categories of data and data subjects.
- Fill in recipients, international transfer, retention and security measures.
- Read the completeness check and the warnings, and fix what is missing.
- Export as CSV to keep the spreadsheet or as DOCX to circulate and approve.
What each field asks for
| Field | What to enter |
|---|---|
| Organisation | Name of the controller or processor keeping the record. |
| Role of the organisation | A controller decides on the processing; a processor processes on behalf of another. |
| DPO and contact channel | Role and a channel, never unnecessary personal data. |
| Activity | E.g. student enrolment |
| Purpose | E.g. enrol students and collect monthly fees |
| Lawful basis | |
| Data categories | E.g. name, email, payment details |
| Data subjects | E.g. students |
| Recipients | E.g. payment processor (processor) |
| International transfer | |
| Retention | E.g. 5 years after the contract ends |
| Security measures | E.g. encryption and role-based access |
Example
A fictional online language school records three activities: student enrolment (contract), an email newsletter (consent) and platform usage analytics (legitimate interests). The tool shows 3 activities, 2 complete and 67% completeness. Usage analytics is flagged because its retention is missing, gets the reminder to record a legitimate interests assessment, and the alert for an international transfer without a defined safeguard.
When to use
- When starting a privacy programme, as the first inventory of personal data.
- Before a DPIA, to see which activities carry the highest risk.
- When a regulator, a client or an audit asks for the record of processing.
- At the annual review, or when a system, vendor or purpose changes.
Frequently asked questions
Is a ROPA mandatory under the GDPR?
Yes. Article 30 requires controllers and processors to keep a record of processing activities and make it available to the supervisory authority on request. The exemption for small organisations is narrow, as explained below.
What must a ROPA contain?
For controllers: name and contact details of the controller and DPO, purposes, categories of data subjects and personal data, categories of recipients, international transfers and safeguards, erasure time limits and, where possible, a general description of security measures. Many organisations also record the lawful basis.
How does a processor record differ from a controller record?
The controller records its own activities and purposes. The processor records the categories of processing it carries out for each controller it serves, with transfers and security measures. An organisation can be both and keep both records.
Are small businesses exempt?
The GDPR exemption for organisations with fewer than 250 employees (Art. 30(5)) does not apply when processing is likely to result in a risk, is not occasional or involves special category or criminal data, which in practice covers almost everyone. Brazil’s LGPD allows a simplified record for small agents rather than an exemption.
Why does the tool warn about legitimate interests?
Legitimate interests requires a documented balancing test, the legitimate interests assessment (LIA), showing the purpose, the necessity and the balance against people’s reasonable expectations. The lawful basis selector helps you draft it.
Is the result legal advice?
No. It is an educational tool that structures the record and points out gaps. Review the content with your DPO and legal counsel, and check the rules currently in force before adopting it.
Which DPCert certification covers the ROPA?
The DPAI (Data Protection & AI Professional) assesses accountability tools, including the record of processing activities and the DPIA, as well as lawful bases and data subject rights.