What is RoPA (Records of Processing Activities)?

The RoPA is the accountability principle in table form. For controllers, each entry must record the organization's name and contacts, the purposes of the processing, categories of data subjects and personal data, categories of recipients, any transfers to third countries and their safeguards, envisaged retention periods, and a general description of security measures. Processors keep a parallel, slightly shorter record of processing performed for each controller. Regulators can demand the RoPA on request, and it is routinely the first document asked for in an investigation.

Article 30(5) exempts organizations with fewer than 250 employees — but the exemption collapses if the processing is more than occasional, creates risk to individuals, or touches special-category data. Since customer databases, marketing lists, and website analytics are all continuous rather than occasional, virtually every operating business processing personal data systematically needs the record despite the headcount carve-out.

The useful way to build a RoPA is by activity, not by system: 'order fulfillment,' 'email marketing,' 'fraud screening,' 'website analytics' — each with its data categories, legal basis (recording it here is best practice, feeding privacy-notice and DSAR answers), recipients, retention, and safeguards. Built that way, the RoPA becomes the master index of the privacy program: DSARs consult it to find data, DPIAs cite it, the privacy policy summarizes it.

Its failure mode is staleness. A RoPA drafted for launch and never updated is evidence of a paper program; tying updates to vendor onboarding and data mapping keeps it aligned with reality.