Record of Processing Activities (ROPA)
Definition
The inventory of processing operations required under Article 30. It documents the purposes, data categories, recipients, retention periods, and security measures for each processing activity. Supervisory authorities request it as the first document in any investigation.
- Legal basis
- GDPR Article 30
- Contents
- Purposes, data categories, recipients, retention
- Also documents
- Security measures per activity
- Regulatory use
- First document requested in an investigation
Common questions
Does every organisation processing personal data need to maintain a ROPA?+
Article 30 exempts organisations with fewer than 250 employees unless their processing is not occasional, involves special-category data, or risks the rights of data subjects, so many small organisations doing routine HR or customer processing still need one despite the size threshold.
Why do supervisory authorities ask for the ROPA before anything else in an investigation?+
It gives regulators a structured map of what data an organisation holds and why, letting them quickly identify which processing activities relate to the complaint or breach under investigation rather than starting from an open-ended inquiry.
Related terms
- Controller
- The natural or legal person, authority, agency, or other body that determines the purposes and means of processing personal data. The controller...
- Data Protection Impact Assessment (DPIA)
- A structured risk assessment required under Article 35 before any processing that is likely to result in high risk to individuals' rights...
- Lawful Basis
- One of the six conditions listed in Article 6 that must be satisfied before personal data may be processed. The controller must...
- Processor
- A natural or legal person that processes personal data on behalf of the controller. Processors are directly bound by certain GDPR obligations...
- Supervisory Authority
- The national data protection regulator responsible for enforcing GDPR in a given EU member state, such as the UK Information Commissioner's Office...