Record of processing activities (RoPA): how to build and maintain it in 2026
Record of processing activities step by step: Art. 30 GDPR elements, controller vs processor records, under-250 exemption, a sample entry and typical errors.
ZeroLayer Team 15 min read
A record of processing activities (RoPA) is a document in which the controller describes every personal data processing activity in the organisation: for what purpose, whose data and which categories of it, to whom it is disclosed, how long it is kept and how it is protected. The obligation follows from Art. 30(1) GDPR. A processor, that is, a company acting on behalf of a controller, keeps a separate record of categories of processing activities under Art. 30(2) (in Polish practice abbreviated RKCP; below we call it the processor record). This article reflects the position as at October 2026: what each record contains, when a small company can do without them, how to build a record in six steps and which mistakes to avoid.
What is a record of processing activities
A record of processing activities is an orderly list of the processes in which the organisation uses personal data, with the information required by Art. 30(1) GDPR. Recital 82 GDPR gives two purposes: the record helps the controller and the processor demonstrate compliance with the Regulation, and the supervisory authority can use it to monitor processing.
The GDPR does not define a “processing activity”. In its guidance on Art. 30, the President of the Polish Data Protection Authority (UODO) takes it to mean a set of related operations on data that can be described collectively by their purpose. Recruiting employees is one activity, while collecting CVs, shortlisting and interviews are operations within it, which are not described separately.
The record is a tool of the accountability principle. Art. 5(2) GDPR provides that the controller is responsible for compliance with the processing principles and must be able to demonstrate it. Without an up-to-date list of processes, it is hard to show that data is not kept longer than necessary or that every vendor has a data processing agreement.
What a record of processing activities must contain (Art. 30(1))
Art. 30(1) GDPR lists seven groups of information. Two of them (points (f) and (g)) are completed “where possible”, but it is good practice to justify an empty field.
| Point | Element of the record | Notes |
|---|---|---|
| a | Name and contact details of the controller, joint controllers, representative and DPO | UODO recommends giving them once, on the title page |
| b | Purposes of the processing | The purpose sets the boundaries of the activity |
| c | Categories of data subjects and categories of personal data | E.g. job applicants; contact details, career history |
| d | Categories of recipients, including in third countries | According to UODO, these include processors, but not the controller's own employees |
| e | Transfers to a third country or an international organisation | Including the name of the country; for transfers under the second subparagraph of Art. 49(1), also documentation of the safeguards |
| f | Envisaged time limits for erasure, where possible | A period or a criterion |
| g | General description of the security measures under Art. 32(1), where possible | With a reference to the detailed documentation |
The list is mandatory but not closed. The President of UODO points to elements that make it easier to demonstrate compliance: the legal basis, the source of the data, the IT system, information on the data protection impact assessment (DPIA), the process owner and details of the processors. UODO's record template contains most of these columns and marks the elements required by law in red.
The description of security measures can be general. Art. 32(1) GDPR gives examples of measures, including pseudonymisation and encryption, the ability to restore access to data in a timely manner after an incident, and regular testing of safeguards. UODO recommends stating the type of safeguards and referring to the documentation, e.g. the information security management system. Our article on the ISMS and information security policy (in Polish) describes how to build such a system.
- 7
- groups of information in the controller's record of processing activities
- Art. 30(1)(a)–(g) GDPR
- 4
- groups of information in the processor's record of categories of processing activities
- Art. 30(2)(a)–(d) GDPR
- 250
- persons: the headcount threshold in the exemption from the record-keeping obligation
- Art. 30(5) GDPR
- EUR 10 million
- or 2% of total worldwide annual turnover: the maximum fine for infringing, among others, Art. 30
- Art. 83(4)(a) GDPR
The processor record of categories of processing activities
The record of categories of processing activities is kept by the processor: an accounting firm, a hosting provider, an IT company maintaining an HR system, a document shredding company. Art. 30(2) GDPR requires it to contain:
- the name and contact details of the processor, of each controller on behalf of which it acts, of representatives and of the DPO,
- the categories of processing carried out on behalf of each controller,
- transfers of data to a third country or an international organisation,
- where possible, a general description of the security measures under Art. 32(1).
The GDPR does not define “categories of processing”. The President of UODO takes this to mean the type of service the processor provides to the controller, e.g. providing IT infrastructure, keeping accounting and HR records, archiving or destroying data carriers. Entries are organised by type of service, and the controllers are listed within each one.
The processor record does not include purposes of processing, categories of data subjects and data, or recipients, because these are decided by the controller. The processor may add, for example, the name of the system, the duration of the contract and details of sub-processors (Art. 28(4) GDPR). Entries follow from the data processing agreements under Art. 28, so every agreement should have a counterpart in the record. When an incident occurs at the processor, the record quickly shows which controllers need to be notified. The division of obligations in such a situation is discussed in our article Personal data breach at a vendor: who notifies and when the 72 hours start (in Polish).
Controller RoPA vs processor record: comparison
The controller describes why it processes data and whose. The processor describes what services it provides and for whom.
| Criterion | Record of processing activities (RoPA) | Record of categories of processing activities (processor record) |
|---|---|---|
| Legal basis | Art. 30(1) GDPR | Art. 30(2) GDPR |
| Who keeps it | The controller and its representative | The processor and its representative |
| Unit of entry | An activity defined by its purpose | A category of processing, i.e. a type of service |
| Purposes, categories of data subjects and data, recipients | Yes (points (b)–(d)) | No |
| List of controllers on whose behalf it acts | No (joint controllers in point (a)) | Yes (point (a)) |
| Transfers to third countries | Yes (point (e)) | Yes (point (c)) |
| Time limits for erasure | Yes, where possible (point (f)) | No |
| General description of security measures under Art. 32(1) | Yes, where possible (point (g)) | Yes, where possible (point (d)) |
| Form and making available | In writing, including electronic form; on request of the authority (paragraphs 3 and 4) | As for the RoPA |
Joint controllers each keep their own record. UODO derives this from the word “each” in Art. 30(1) and recommends that each of them describe the processes covered by joint control.
Who does not have to keep a record: the Art. 30(5) exemption
The exemption covers an enterprise or organisation employing fewer than 250 persons, but only where its processing is not likely to result in a risk to the rights and freedoms of data subjects, is occasional, and does not include special categories of data under Art. 9(1) or data relating to criminal convictions under Art. 10.
The Article 29 Working Party explained this provision in its position paper of 19 April 2018, which the European Data Protection Board endorsed at its first plenary meeting. Four conclusions follow from it:
- The conditions are alternative: each of them on its own means the obligation to keep a record applies.
- It refers to any risk, not only high risk, so the threshold is lower than for a DPIA under Art. 35.
- An activity is occasional only if it is not carried out regularly and falls outside the regular course of business. A small organisation processes employee data regularly, so that data goes into the record.
- The record can be partial: it covers activities that meet one of the conditions, while truly occasional activities, with no risk and no special categories of data, can be left out.
In effect, the exemption releases organisations from describing individual, rare activities rather than from keeping a record at all. An organisation that relies on it should record its reasoning, because the accountability principle requires this.
Will the 250-person threshold change?
On 21 May 2025 the European Commission presented a proposal for a regulation, COM(2025) 501 (the Omnibus IV package). Under the proposal, the exemption would cover organisations employing fewer than 750 persons, and the record would be mandatory only for processing likely to result in a high risk within the meaning of Art. 35. According to EUR-Lex, procedure 2025/0130/COD is ongoing (as at 24 October 2026), so the 250-person threshold and the three conditions described above apply.
Form of the record and making it available to the supervisory authority
Art. 30(3) GDPR requires written form, including electronic form: it can be a spreadsheet, a text document or a compliance management system. The GDPR does not prescribe a layout, and the President of UODO notes that its templates are not the only correct models.
Art. 30(4) requires the record to be made available to the supervisory authority on request, in Poland the President of UODO. According to UODO, reviewing the record may be one of the authority's first steps during an inspection, so the record must be ready in advance. We cover preparing for a UODO inspection in the inspection preparation section.
How to build a record of processing activities step by step
Step 1: Decide who is responsible and who takes part
The obligation rests with the controller, and decisions are taken by management. UODO points out that Art. 30 is not addressed to the data protection officer: the DPO advises and uses the record, but is not responsible for keeping it. The work usually involves the DPO as coordinator, process owners (heads of departments), IT, who know where the data is and how it is protected, and HR and payroll, because employee data covers several separate activities.
Step 2: Inventory processes department by department
With each department, answer the question: what personal data comes to you, why, and what happens to it next. UODO advises reflecting the actual division of tasks: in a large company HR and payroll may be separate activities, in a small one a single activity. A list of IT systems, contracts with vendors and forms on the website are helpful.
Step 3: Group operations into activities by purpose
“Issuing an invoice”, “entering it in the VAT register” and “submitting the JPK file” are, in UODO's example, parts of a single activity, “handling sales contracts”. If two different legal bases and two different erasure periods appear in one row, that is usually a sign that there are two activities.
Step 4: Complete the elements of Art. 30(1)
For each activity, fill in points (b)–(g), and give the controller's and DPO's details once on the title page. If data goes outside the European Economic Area, name the country. Add columns that are useful during an inspection: legal basis, system, process owner, DPIA information.
Step 5: Describe the security measures together with IT
A few sentences per activity are enough: where the data is, how access is controlled, whether it is encrypted, how backups are made. The details stay in the security policy.
Step 6: Verify, approve and schedule reviews
Process owners check their rows, management approves the record, and the version date is recorded in the document's metadata. The approved record is the starting point for checking data processing agreements, privacy notices and the risk analysis. We describe this in more detail in our article GDPR audit step by step.
Record of processing activities: sample entry
The entry below concerns a fictitious service company and shows the level of detail. In a real record, the content follows from the organisation's actual situation.
| Field | Sample content (fictitious) |
|---|---|
| Name of activity | Handling enquiries from the contact form on the website |
| Unit / process owner | Sales department, sales manager |
| Purpose (point (b)) | Responding to the enquiry and preparing commercial information at the enquirer's request |
| Legal basis (optional) | Art. 6(1)(f) GDPR, legitimate interest in responding to enquiries |
| Categories of data subjects (point (c)) | People sending an enquiry, including company representatives |
| Categories of data (point (c)) | First name and surname, email, phone, company name, content of the enquiry |
| Categories of recipients (point (d)) | Website hosting provider, CRM system provider (processors) |
| Transfer to a third country (point (e)) | None |
| Time limit for erasure (point (f)) | 12 months from the end of correspondence if no contract was concluded (sample decision of the controller) |
| Security measures (point (g)) | Encrypted connection to the form, CRM access only for the sales department on named accounts with multi-factor authentication, backups; details in the information security policy |
| DPIA (optional) | Not required, reasoning in the assessment note |
As a template for the record, you can use the President of UODO's templates, which include examples for a primary school and several types of processor services.
How often to update the record
The GDPR does not specify how often to update the record, but an out-of-date record does not allow you to demonstrate compliance with Art. 5(2). We suggest two mechanisms.
| Mechanism | When | What to do |
|---|---|---|
| Update on change | New process, system or vendor, change of purpose, transfer of data outside the EEA, end of a process | Change the row before the change goes live |
| Periodic review | Once a year, more often if changes are frequent | Compare the record with the list of IT systems, data processing agreements and the organisational structure |
A simple procedure helps: a request for a new tool or vendor goes to the person responsible for the record before anyone enters data into it.
Common mistakes in a record of processing activities
- Describing operations instead of activities: hundreds of rows such as “saving to the database” are unreadable for the authority.
- Overly general purposes, e.g. “running a business”, which do not allow the adequacy of the data to be assessed.
- Listing your own employees as recipients, even though according to UODO they are not.
- Empty erasure time limits, or “indefinitely” for most activities.
- A processor with only a processor record and no RoPA for the data of its own employees and business partners.
- A record prepared once, in 2018, and never reviewed.
- Relying on Art. 30(5) despite regular processing, risk or special categories of data.
How to check whether your record is complete
A simple test: does every system containing personal data, every data processing agreement and every form that collects data have its own row in the record? SelfAudyt, a self-assessment tool (not an external audit or a legal opinion), asks a question in its GDPR module about the Art. 30 record of processing activities and has a template for it in its document library. The quick 8-question test gives an indicative result.
FAQ
Does a small company have to keep a record of processing activities?
Usually yes. The Art. 30(5) GDPR exemption for organisations employing fewer than 250 persons does not apply if the processing is likely to result in any risk, is not occasional, or includes special categories of data or data relating to criminal convictions. According to the Article 29 Working Party, employee data is processed regularly, so it goes into the record even in a small organisation.
What is the difference between a record of processing activities and a record of categories of processing activities?
The RoPA is kept by the controller and describes the purposes, categories of data subjects and data, recipients, erasure time limits and security measures (Art. 30(1) GDPR). The record of categories of processing activities is kept by the processor and lists the types of services provided to individual controllers, transfers to third countries and security measures (Art. 30(2)).
Can the record be kept in Excel?
Yes. Art. 30(3) GDPR requires written form, including electronic form, and does not prescribe a tool. A spreadsheet is enough if it contains all the elements of Art. 30(1) or (2) for all processes and is kept up to date.
What is the fine for not having a record of processing activities?
Infringing the obligations under Art. 25–39 GDPR, including Art. 30, is subject to a fine of up to EUR 10,000,000 or, in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(4)(a) GDPR). This is the upper limit, and the amount of the fine in a specific case depends on the circumstances in Art. 83(2).
Will the 250-employee threshold be raised to 750?
That is the European Commission's proposal of 21 May 2025 (COM(2025) 501), under which organisations with fewer than 750 persons would have to keep a record only for high-risk processing. According to EUR-Lex the procedure is ongoing, so as at 24 October 2026 the current wording of Art. 30(5) applies.
Disclaimer
This article is for information purposes only, reflects the law as at 24 October 2026 and is not legal advice. The sample entry concerns a fictitious organisation. A self-assessment in SelfAudyt does not replace an audit or a legal opinion. Consult a data protection officer or a lawyer on the scope of your record and on whether you can rely on the Art. 30(5) exemption.
Sources
- Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Art. 5, 30, 32, 83 and Recitals 13 and 82 — EUR-Lex
- Guidance and explanations on the obligation to record processing activities and categories of processing activities under Art. 30(1) and (2) GDPR — Polish Data Protection Authority (UODO), in Polish
- Article 29 Working Party position paper on the derogations from the obligation to maintain records of processing activities pursuant to Art. 30(5) GDPR — UODO (Polish version)
- Position Paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR — European Data Protection Board, 19 April 2018
- Proposal COM(2025) 501 final (Omnibus IV) — European Commission, 21 May 2025
- Procedure 2025/0130/COD — EUR-Lex, as at 24 October 2026
Read next
Compliance
Business continuity plan (BCP) and disaster recovery plan (DRP): what to include and what NIS2 requires
Business continuity and disaster recovery plans: how they differ, what to include, how to test them and what NIS2, the Polish KSC Act and GDPR require in 2026.
16 min read
Compliance
GDPR audit step by step: what to check before an auditor or a UODO inspection
GDPR audit step by step: 12 areas with legal provisions, evidence and a remediation plan, plus what Polish law says about how a UODO inspection works.
15 min read
Compliance
5×5 risk matrix and risk register: how to assess information security risk
A 5×5 risk matrix for information security: likelihood and impact scales, acceptance thresholds, a sample risk register and KSC, NIS2 and GDPR requirements.
16 min read