Record of Processing Activities (ROPA)

The Record of Processing Activities (ROPA) is one of the central instruments of GDPR compliance. Under Art. 30 GDPR, every controller is required to maintain such a record in writing — including in electronic form — and to make it available to the supervisory authority upon request. It forms the documentary backbone of the accountability obligation under Art. 5(2) GDPR.

For each processing activity, the ROPA must contain at minimum: the name and contact details of the controller, the purposes of the processing, a description of the categories of data subjects and personal data, the categories of recipients, any third country transfers and the safeguards applied, the envisaged retention periods, and a general description of the technical and organisational security measures. Processors must maintain their own record covering all processing activities carried out on behalf of controllers.

In practice, the ROPA is far more than a bureaucratic formality. As a compliance officer, it gives you a systematic overview of all data flows within the organisation, helps you identify risks early, and supports your assessment of whether a Data Protection Impact Assessment (DPIA) is required. The exemption for organisations with fewer than 250 employees only applies if the processing carries no risk to data subjects, is not carried out on a regular basis, and does not involve special categories of data — conditions that are rarely met in practice.