What is a RoPA?
A Record of Processing Activities (RoPA) is the inventory of personal-data processing that Article 30 of the GDPR requires most organizations to keep. For each activity it records the purpose, categories of people and data, recipients, international transfers, retention periods and security measures, and it must be shown to regulators on request.
TL;DR
- Required by GDPR Article 30.
- Controllers and processors keep separate records.
- Keep it current as systems and vendors change.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
How does a RoPA work in practice?
Under Article 30 of the GDPR, many organizations must maintain a Record of Processing Activities. The RoPA catalogues each processing activity along with its purpose, the categories of data subjects and personal data involved, recipients, international transfers, retention periods, and the security measures applied.
The RoPA serves as the foundational map of an organization's data flows. It supports other privacy obligations — responding to data-subject requests, scoping DPIAs, and assessing vendor risk — because it shows where personal data lives and how it moves.
Keeping the RoPA current is an ongoing task. As products and integrations change, new processing activities must be added, which is why many teams maintain the RoPA in a tool that links it to the underlying systems and vendors.
What else do people ask about a RoPA?
Do small companies need a RoPA?
Often, yes. Article 30(5) exempts organizations with fewer than 250 employees only when their processing is occasional, unlikely to result in a risk, and excludes special-category and criminal-offence data, so regular processing such as payroll usually needs a record.
What format should a RoPA use?
Any written form, including electronic, that you can make available to the supervisory authority on request.
Go deeper: GDPR compliance guide
Which terms are related to a RoPA?
- GDPRThe General Data Protection Regulation (GDPR) is the EU law, applying since 25 May 2018, that governs how organizations process the personal data of people in the EU. It requires a lawful basis, transparency and security, gives individuals rights such as access and erasure, and allows fines of up to €20 million or 4% of worldwide turnover.
- DPIAA Data Protection Impact Assessment (DPIA) is a structured review, required by Article 35 of the GDPR, that an organization completes before starting processing likely to pose a high risk to people’s rights. It describes the processing, tests necessity and proportionality, identifies risks, and records the measures that reduce them.
- Vendor Risk ManagementVendor risk management (VRM) is the process of identifying, assessing and monitoring the security, privacy and operational risks that suppliers and service providers bring. A typical program inventories vendors, tiers them by criticality and data access, reviews questionnaires and attestations such as SOC 2 reports, and tracks remediation and contract terms over time.
- Evidence CollectionEvidence collection is gathering the records that prove compliance controls are designed well and operating as intended, such as access reviews, configuration exports, change tickets, scan results and policy acknowledgements. Auditors sample this evidence across the audit period. Automated collection pulls it from source systems on a schedule instead of relying on screenshots.