What are Article 30 records under the UK GDPR?
Article 30 records are the written records of processing activities that controllers and processors must keep under Article 30. In plain English, they are the internal register that says what personal data you process, why you process it, who receives it, whether you transfer it, how long you keep it, and what security measures you use.
Teams should treat Article 30 Records under the UK GDPR as a source-linked operating decision: confirm whether the issue affects controller/processor roles, lawful basis, transparency, DPIA, data-subject rights, breach notification, IDTA/Addendum transfers, children data, or ICO enforcement exposure, assign the team that can change the process, and keep evidence showing the action and review trigger.
The safest first step is to identify the controller/processor role, purpose, lawful basis, special-category status, right, breach, transfer, or child-data trigger before assigning the UK GDPR action.
- Write the Article 30 Records decision in one sentence before drafting controls.
- Attach the external source URL and a short source quote to the evidence record.
- Route unclear cases to legal, privacy, security, or compliance review before launch.
ICO guidance lists the controller and processor information that should be documented for Article 30 records.
ICO accountability framework connects ROPA completeness with documenting and justifying lawful bases under Articles 6, 9, and 10.
ICO audit material supports keeping accountable evidence that Article 30 records and review controls are operating in practice.