Glossary
Records of processing activities (RoPA)
The written inventory of processing activities that controllers and processors must maintain under GDPR Article 30.
Article 30 GDPR requires controllers and processors to maintain records of processing activities, often called the RoPA. Under Article 30(1), a controller's record includes its contact details, the purposes of processing, categories of data subjects and personal data, categories of recipients, transfers to third countries, envisaged erasure time limits where possible, and where possible a general description of the Article 32(1) security measures. Article 30(2) sets a shorter list for processors. Records must be in writing, including electronic form, and be made available to the supervisory authority on request.
Article 30(5) exempts organisations with fewer than 250 employees, but only where the processing is not likely to result in a risk, is occasional, and does not include special categories or criminal convictions data. Because most regular processing is not occasional, the exemption rarely applies in full.
For IT teams, the RoPA should not be a spreadsheet maintained in isolation. It can be built from and reconciled with the CMDB, asset inventory and data flow diagrams, and it gives incident responders a fast way to identify what data an affected system holds. See our guide to records of processing activities.