RoPA
Record of Processing Activities — a mandatory inventory of all personal data processing activities under GDPR Article 30.
Full Definition
A Record of Processing Activities (RoPA) is a written inventory that documents all personal data processing activities within an organisation. GDPR Article 30 requires both controllers and processors to maintain a RoPA (with a limited exception for organisations with fewer than 250 employees, unless processing is high risk). A controller RoPA must include: the name and contact details of the controller, purposes of processing, description of data subject categories and data categories, recipient categories, international transfer information, and, where possible, envisaged retention periods and security measures. The RoPA is the foundation of an organisation's data governance program and is routinely requested by data protection authorities during investigations.
How each law treats it
Record of Processing Activities. Controllers (Article 30(1)) and processors (Article 30(2)) must maintain the record and make it available to the supervisory authority on request.
Significant Data Fiduciaries must maintain a record of processing comparable to GDPR Article 30. The specific fields are set in the DPDP Rules 2025.
Controllers and processors must maintain a record of processing that the UAE Data Office can inspect. The record is a baseline accountability obligation.
In practice
- The unit of accounting is the processing activity, not the system. A single CRM may host 3–4 activities; a single activity may span 3–4 systems.
- Keep the RoPA chained to the data map. Each row references data categories, data flows, sub-processors and transfers maintained in parallel sheets.
- Review the RoPA on every material change. The ICO publishes evidence that stale RoPAs are the single most frequent accountability finding in GDPR enforcement.
Common pitfalls
- Spreadsheets that drift. Above ~50 activities the review overhead becomes unmanageable.
- Missing the processor's Article 30(2) record. Processors have their own obligation — don't just share the controller's RoPA.
- Treating the RoPA as a one-shot. The regulator will ask when it was last reviewed; a quarterly cadence is the baseline.
Frequently asked questions
Is the RoPA mandatory for small businesses?+
The GDPR Article 30(5) derogation for organisations with fewer than 250 employees is narrow — most processing (regular, non-occasional, special category) still triggers the obligation. In practice, most organisations maintain a RoPA regardless.
What's the difference between the controller RoPA and the processor RoPA?+
Article 30(1) covers controller obligations (purposes, categories, recipients, transfers, retention). Article 30(2) covers processor obligations (controller identity, categories of processing, transfers, security measures). The structures differ.
Can I use the RoPA as my notice content?+
No. The RoPA is an internal accountability document; the notice is external and plain-language. They often share the same source data (purposes, categories) but the forms differ.
Related terms
Data Controller
An entity that determines the purposes and means of processing personal data.
Data Processor
An entity that processes personal data on behalf of and under the instructions of a Data Controller.
DPIA
Data Protection Impact Assessment — a systematic process to identify and minimise privacy risks in new processing activities.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes