RoPA Excel Template
An Article 30-compliant Record of Processing Activities spreadsheet with pre-built columns for processing purpose, legal basis, data categories, retention periods, and third-party transfers.
What's included
- Processing activity name and description
- Controller and DPO contact details
- Purposes and lawful basis columns
- Data subject categories
- Personal data categories
- Recipients and third-party columns
- International transfer details
- Retention period and deletion schedule
- Technical and organisational security measures
How to use this template
- Open the Excel workbook. Each sheet maps to a different scope: Processing Activities, Data Categories, Data Flows, Sub-processors, Transfers Register, DPIAs. Start with Processing Activities.
- Build one row per processing activity, not one row per application. The GDPR Article 30 unit of accounting is the activity — a single CRM may host 3–4 distinct activities.
- Fill in lawful basis per activity. If you use legitimate interests, add the balancing test reference in the LIA column — the auditor will ask for it.
- Chain the sheets. Each row in Processing Activities references rows in Data Categories, Data Flows and Sub-processors via the IDs in the lookup sheet.
- Export the Processing Activities sheet to PDF as your Article 30 record. Replace the template entirely with TruePrivacy's live RoPA once your data map stops fitting in a spreadsheet.
Download template
Free to download. Just fill in your details.
Need an automated version of this document? TruePrivacy generates and maintains compliance documents automatically as your data processing activities change.
Try TruePrivacy freeFrequently asked questions
Is this template Article 30 compliant?+
The schema matches every field GDPR Article 30(1) requires for controllers and Article 30(2) for processors. You still need to fill in the content; the template is the structure the DPA expects.
What's the right unit of accounting — activity, system or dataset?+
Activity. GDPR Article 30 says 'processing activities under its responsibility'. A single system may host multiple activities (customer-support emails vs marketing automation on the same CRM); a single activity may span multiple systems. The template encodes activity-first.
Does it cover the DPDP Act's RoPA expectations?+
DPDP § 10 doesn't use the word 'RoPA' but a Significant Data Fiduciary must maintain a comparable record. The template's columns cover DPDP's Section 6 notice, Section 8 security obligations and Section 11 breach reporting references.
What about cross-border transfer documentation?+
The Transfers Register sheet records recipient country, legal mechanism (SCCs / BCRs / adequacy / explicit consent / CBPR) and a link to the transfer safeguard document. Match each transfer in the register to a row in the sub-processors sheet.
When should I retire the Excel approach?+
When your activity count passes ~50, or when cross-functional updates are required weekly. At that point the review overhead of a spreadsheet becomes the single biggest source of staleness — switch to a live RoPA that auto-updates from data discovery.
Beyond templates: automated compliance
Static templates are a start. TruePrivacy keeps your privacy documentation accurate and up to date automatically.
Free 14-day trial · No credit card required · Setup in minutes