# Record of Processing Activities (ROPA)

> GDPR Art.30 record – the mandatory inventory of every processing
> activity. Art.30(1) prescribes exactly which fields a controller's
> record must contain; regulators ask for this document on request.

| Field | Value |
|-------|-------|
| Doc ID | DOC-GDPR-NNN |
| Controller | [legal entity] |
| DPO / contact | @name |
| Last reviewed | YYYY-MM-DD |
| Review cycle | [quarterly / on change] |
| Classification | Internal – contains processing map |

## Controller details

| Field | Value |
|-------|-------|
| Name | [legal entity + address] |
| Representative (if non-EU) | [Art.27 rep] |
| DPO | [name / contact, if appointed] |

## Processing activities

One row per activity – Art.30(1) requires all columns present:

| # | Activity | Purpose | Data subjects | Data categories | Recipients | Third-country transfer | Retention | TOMs ref |
|---|----------|---------|---------------|-----------------|------------|------------------------|-----------|----------|
| PA-01 | e.g. account management | service delivery | customers | name, email, prefs | internal, [processor] | [SCCs / none] | [period] | TOM-NN |
| PA-02 | | | | | | | | |

## Lawful basis per activity

| # | Lawful basis (Art.6) | Special category basis (Art.9) | Notes |
|---|----------------------|--------------------------------|-------|
| PA-01 | contract / consent / legitimate interest | | |
| | | | |

## Special category processing

| Activity | Special data | Art.9 condition | DPIA ref |
|----------|--------------|-----------------|----------|
| | | | |

## Data sharing & transfers

| Recipient | Role (proc/joint/ind.) | Mechanism | Location |
|-----------|------------------------|-----------|----------|
| [processor] | processor | DPA + SCC | [country] |

## Processors' records (Art.30(2))

Processors keep their own record of processing on your behalf –
verify they maintain one; list the responsible contracts here.

| Processor | Service | DPA signed | Their ROPA verified |
|-----------|---------|------------|---------------------|
| | | YYYY-MM-DD | [ ] |

## Maintenance

- [ ] Updated on every new/changed processing activity
- [ ] Reviewed at least [quarterly]
- [ ] Available to supervisory authority on request
- [ ] Aligned with DPIAs and legal register entries