Artifact TemplateEU GDPR

GDPR Article 30 Record of Processing Activities Template

Use this RoPA template to document the Article 30 fields that controllers and processors must be able to maintain in writing and make available to a supervisory authority on request.

The template separates controller and processor records, then turns purposes, data-subject categories, personal-data categories, recipients, transfers, erasure time limits, and security measures into usable evidence fields.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

A GDPR record of processing activities should be a self-contained inventory of real processing activities, not a policy reference or a list of system names. Start with the role for each activity, then complete the Article 30 fields that apply to that role. Under Article 30(5), organisations with fewer than 250 employees may be exempt unless the processing is likely to result in a risk to people's rights and freedoms, is not occasional, or includes special-category data or personal data relating to criminal convictions and offences.

Section 1

Controller RoPA fields to include

Use one row per processing activity or sub-activity. The row should be granular enough for an external reader to understand why the data is used, whose data is involved, which data categories are processed, who receives it, whether it leaves the EEA or goes to an international organisation, how long it is kept, and which security measures protect it.

Mark Article 30 fields separately from helpful extra fields. Lawful basis, special-category condition, risk rating, DPIA reference, breach reference, and transfer mechanism can make the record more useful, but they should not hide the prescribed Article 30 information.

Record owner fields: controller name and contact details, joint controller if any, controller representative if any, DPO if any, business function, process owner, and last reviewed date.
Activity fields: processing activity, sub-activity, purpose of processing, systems or locations used, and whether the row is active, planned, or archived.
People and data fields: categories of data subjects, categories of personal data, and separate flags for Article 9 special-category data or Article 10 criminal-offence data where relevant.
Disclosure fields: categories of recipients, including internal recipient groups, external recipients, processors, other controllers, recipients in third countries, and international organisations.
Transfer fields: third country or international organisation, transfer route or safeguard, Article 49 safeguard documentation where relied on, and where the supporting transfer document can be produced.
Retention and security fields: envisaged erasure time limits by data category, retention trigger, deletion or archive owner, and a general description of technical and organisational security measures.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 30(1) lists the controller RoPA fields, including purposes, data-subject and personal-data categories, recipients, transfers, erasure time limits, and Article 32 security measures.

Irish Data Protection Commission - Records of Processing Activities under Article 30 GDPR

DPC guidance supports granular, self-contained RoPA rows and recommends making mandatory Article 30 fields easy to identify.

Section 2

Processor RoPA fields to keep separate

Processors need a different Article 30 record. Do not reuse the controller template without changing the row logic: a processor row should start with the controller on whose behalf the processing is carried out and the categories of processing performed for that controller.

A processor record can still use many of the same evidence fields, but the role statement must show that the processor is processing on behalf of a controller and that the row is organised around the controller served.

Processor identity fields: processor name and contact details, any other processor involved, processor representative if any, DPO if any, and the controller for whom the processing is performed.
Controller relationship fields: contract or other binding legal act reference, instruction owner, service or processing category, sub-processor use, and controller approval or authorisation status.
Processing fields: categories of processing carried out on behalf of each controller, systems or hosting locations, access groups, and operational hand-offs.
Transfer fields: any third-country or international-organisation transfer, the country or organisation, and Article 49 safeguard documentation where applicable.
Security fields: general Article 32 security measures, including access controls, encryption or pseudonymisation where used, resilience or availability controls, and testing or assessment cadence where documented.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 30(2) lists the processor RoPA fields, including controllers served, categories of processing, transfers, and Article 32 security measures.

Irish Data Protection Commission - Records of Processing Activities under Article 30 GDPR

DPC guidance explains the processor-side Article 30 record and recommends that processors start with each controller they process data for.

Section 3

Role split and row design

Complete the role assessment before filling the template. Under the GDPR, a controller determines the purposes and means of processing; a processor processes personal data on behalf of a controller; joint controllers jointly determine purposes and means for the relevant processing.

Where the same vendor relationship includes multiple roles, create separate rows. For example, one service may process support-ticket content as a processor while another recipient uses payment or banking data for its own controller purpose.

Role evidence prompt: who decides why the data is processed and which essential means are used?
Processor evidence prompt: what documented instructions, processing agreement, security requirements, and sub-processor terms govern the activity?
Joint-controller evidence prompt: what arrangement allocates transparency duties, data-subject rights handling, security, breach handling, and contact-point responsibilities?
Recipient evidence prompt: is the recipient an internal team, processor, sub-processor, independent controller, joint controller, public authority, third-country recipient, or international organisation?
Granularity prompt: split rows when purpose, data category, recipient, transfer route, retention period, or security measure differs materially.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

GDPR Articles 4, 26, 28, and 30 support the controller, processor, joint-controller, recipient, and Article 30 record prompts in this template.

Irish Data Protection Commission - Records of Processing Activities under Article 30 GDPR

DPC guidance supports breaking the RoPA down by functions, owners, and processing activities so relevant activities are not omitted.

Section 4

Evidence template rows for common activities

Use these row patterns as evidence prompts, then replace the examples with the organisation's actual facts. Avoid entries such as personal data, internal, appropriate security, or as per retention policy unless the row also states the concrete data, recipients, measures, and retention rule.

The record should be readable without opening internal folders. If a policy, contract, DPIA, transfer impact assessment, or retention schedule is linked, the RoPA row should still summarize the relevant field and identify who can produce the supporting document.

HR payroll row: purpose is payroll and employment administration; data subjects are employees or workers; data categories may include identity, contact, payroll, bank, tax, absence, and deduction data; recipients may include payroll provider, tax authority, pension provider, and bank; retention should be stated by category.
Customer account row: purpose is account creation and service delivery; data subjects are customers, users, admins, or prospects; data categories may include account identifiers, contact details, authentication metadata, usage records, support history, and billing data.
Marketing row: purpose should identify the campaign or communication type; data-subject categories should distinguish prospects, customers, event contacts, and unsubscribed contacts; recipients should include marketing platforms, analytics providers, or agencies where used.
Security logging row: purpose should distinguish access control, fraud prevention, incident investigation, or service resilience; data categories should list identifiers, IP addresses, device data, log timestamps, and event data instead of saying technical data.
Processor service row: start with the controller, categories of processing performed for that controller, sub-processors used, transfer locations, security measures, and how the processor can export the relevant RoPA information to the controller.

Sources for this answer

Irish Data Protection Commission - Records of Processing Activities under Article 30 GDPR

DPC examples show that RoPA rows should use concrete data categories, recipients, retention periods, and security measures rather than labels such as personal data or GDPR compliant.

Regulation (EU) 2016/679 (GDPR)

Article 32 supports recording concrete security measures such as pseudonymisation, encryption, resilience, restoration, and regular testing where appropriate.

Section 5

Transfer, retention, and security checks before use

Before relying on the RoPA, test the fields that usually fail first: transfers, retention, and security. These fields should not be buried in linked documents or left as unexplained shorthand.

A usable Article 30 record should let privacy, legal, security, vendor management, and product owners answer the same questions from the same row: what processing is happening, why it is happening, who receives the data, where it goes, when it is erased, and how it is protected.

Transfer check: each third-country or international-organisation transfer identifies the destination, recipient or recipient category, transfer mechanism or safeguard, and supporting document owner.
Retention check: each activity states the envisaged erasure time limit where possible and avoids unsupported entries such as indefinitely, as needed, or see policy.
Security check: each activity has a general description of relevant technical and organisational measures, such as access control, encryption, segregation, logging, backup, resilience, testing, or staff controls where actually used.
Availability check: the record is in writing, including electronic form, and can be exported as a readable standalone record if a supervisory authority requests it.
Update check: new products, vendors, data categories, recipients, transfer routes, retention changes, or security-control changes trigger a row update.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

GDPR Articles 30 and 32 support the transfer, erasure-time-limit, security-measure, written-record, and authority-access checks in this template.

European Commission - Standard Contractual Clauses

Commission SCC resources support documenting transfer safeguards where a RoPA row identifies third-country transfers that use standard contractual clauses.

Recommended next step

Use the template to produce controller and processor records

Sorena can help convert systems, vendors, products, and processing purposes into Article 30 rows with cited sources, owner assignments, retention fields, transfer fields, and evidence prompts.

Research workflow

Open Research Copilot for EU GDPR

Ask source-linked questions about Article 30 fields, controller and processor roles, transfers, retention, and security measures using the cited sources on this page.

Explore next step

Talk to Sorena

Talk through implementation

Review your RoPA structure, source gaps, and evidence fields with Sorena.

Explore next step

Primary sources

References and citations

European Commission - Standard Contractual Clauses

commission.europa.eu

Referenced sections

Commission SCC resources support documenting transfer safeguards where a RoPA row identifies third-country transfers that use standard contractual clauses.

"Standard Contractual Clauses"

Irish Data Protection Commission - Records of Processing Activities under Article 30 GDPR

dataprotection.ie

Referenced sections

DPC examples show that RoPA rows should use concrete data categories, recipients, retention periods, and security measures rather than labels such as personal data or GDPR compliant.