GDPR Records of Processing Activities (Article 30): Template

Article 30 requires controllers (and processors) to maintain a Record of Processing Activities (RoPA) and make it available to the supervisory authority on request. This page is a practical template — not a sales pitch.

Related: GDPR hub · Lawful basis · DPIA.

Who needs a RoPA? Controllers and processors, with a limited SME exemption for organisations employing fewer than 250 persons — unless processing is likely to result in risk, is not occasional, or includes special-category / criminal-offence data.

Controller RoPA Columns (Template)

Column

Notes

Processing activity name

e.g. “Customer support tickets”

Purposes

Article 5(1)(b) purpose limitation

Lawful basis (Art 6)

Plus Art 9 condition if special category

Categories of data subjects

Customers, employees, prospects…

Categories of personal data

Contact, billing, usage, special category…

Recipients / processors

Link to Art 28 DPAs

Transfers / safeguards

Adequacy, SCCs, etc. (Chapter V)

Retention period / criteria

Storage limitation

Security measures (overview)

Article 32 TOMs summary

Processor Extras

Processors record categories of processing on behalf of each controller, transfers, and a general description of security measures.

How CyberSilo Helps

Living RoPA rows in CSA tied to systems and vendors
Change detection when new SaaS integrations appear

Replace the Spreadsheet Graveyard

Keep Article 30 records current as systems change — ready for the next authority request.

Talk to CyberSilo GDPR Automation

Frequently Asked Questions

Is RoPA mandatory?

Yes for controllers and processors, subject to the Article 30(5) SME exemption conditions.

Does RoPA replace a DPIA?

No. RoPA inventories processing; DPIAs assess high-risk processing under Article 35.

How often should RoPA be updated?

Whenever processing changes materially — new purposes, vendors, transfers, or retention rules.

GDPR hub · DPA · Retention · CSA

GDPR Records of Processing Activities (Article 30): Template

Controller RoPA Columns (Template)

Processor Extras