Loading…
Loading…
Build your Record of Processing Activities step by step. We guide you through every mandatory Art. 30 field — controller details, data subjects, recipients, international transfers, retention, and security measures. Download the completed ROPA as a markdown file, or create a shareable link.
The legal name of the organisation that determines the purposes and means of processing.
Full registered address of the organisation.
The email address of the DPO or the person responsible for data protection queries.
If another organisation co-determines the purposes and means, they are a joint controller. You must document their details too.
Name, address, and contact email of the joint controller.
14 required fields still missing
Most organisations that process personal data. Art. 30(5) provides a narrow exemption for organisations with fewer than 250 employees — but only if the processing is occasional, doesn't involve special-category data, and is unlikely to pose a risk. In practice, most SMEs should still maintain a ROPA.
Supervisory authorities (e.g. the ICO in the UK, CNIL in France) can request the ROPA at any time. Failing to produce one can result in fines under Art. 83 and is seen as evidence of poor accountability — one of the GDPR's core principles.
Whenever a processing activity changes materially — for example when you onboard a new processor, start collecting a new category of data, or enter a new market. Best practice is a formal annual review, plus ad-hoc updates as changes happen.
No. This tool helps you document your processing activities in a structured way. For legal advice on GDPR compliance, consult a qualified data protection lawyer or a certified DPO.
No. A DPIA (Data Protection Impact Assessment) is required for high-risk processing under Art. 35. The ROPA is a broader inventory of all your processing activities. You reference your DPIAs in the ROPA but they are separate documents.