ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The controller vs processor ROPA question comes up as soon as a business that provides services to other businesses starts its records of processing. Article 30 of the GDPR asks for two different records: one for processing you carry out as a controller, and a shorter one for processing you carry out on behalf of others. Most service providers need both. This guide sets out what each must contain, how they differ, and how to decide which record an activity belongs in.
For the obligation itself and why the small business exemption rarely helps, start with our guide to records of processing. The legal text is Article 30 of the GDPR, paragraphs 1 and 2; the UK GDPR has the same wording.
| Content | Controller record, Article 30(1) | Processor record, Article 30(2) |
|---|---|---|
| Who is named | The controller, any joint controller, the representative and the DPO | The processor, each controller it acts for, their representatives and DPOs |
| Organized by | Processing activity and purpose | Controller (client), or group of clients using the same service |
| Purposes | Required | Not required: the purposes are the controller’s |
| Data subjects and data | Categories of each, required | Not listed separately; described through the categories of processing |
| What is done | Implied by the purpose | Categories of processing carried out for each controller, required |
| Recipients | Categories of recipients, required | Not required, but sub-processors are usually recorded |
| Transfers outside the EEA or UK | Required, with the country and, for some derogations, the safeguards | Required, on the same terms |
| Retention | Time limits for erasure, where possible | Not required: the controller sets it |
| Security measures | General description, where possible | General description, where possible |
The pattern is simple. A controller records why and whose data; a processor records for whom and what it does. The controller vs processor ROPA split follows the split of responsibility in the GDPR itself.
Ask who decides the purpose and the essential means. If you decide why the data is processed, it goes in your controller record. If a client decides and you act on its documented instructions, it goes in your processor record. The European Data Protection Board’s guidelines on the concepts of controller and processor use the same test.
| Field | Example entry |
|---|---|
| Controller and contact | Retail clients using the parcel delivery service; each client’s privacy contact in the client register |
| Categories of processing | Delivering parcels to the client’s customers: names, addresses, phone numbers, delivery instructions, proof of delivery |
| Sub-processors | Transport management system provider; telematics provider |
| Transfers | None outside the EEA |
| Security measures | General description, as in the controller record |
| Contract | Data processing agreement with the Article 28(3) terms in every client contract |
Grouping clients who buy the same standard service keeps the processor record manageable. A client with a bespoke service, or with special category data, deserves its own entry.
Software and service companies feel the controller vs processor ROPA split most sharply, because the same platform holds data in both roles. A typical SaaS provider is:
The cleanest way to handle this is to write the controller record first, by department like any other business, then add one processor entry per service line. Where a use of customer data sits in the grey zone, record the decision and the reason: auditors and enterprise customers ask about exactly these cases, and a documented answer saves a long exchange of questionnaires.
Done in this order, the controller vs processor ROPA question answers itself for most activities, and the few that remain are the ones that genuinely need a legal view.
The controller record changes when your own processes change; the processor record changes when you win or lose a client, change a service, or add a sub-processor. Tie the processor record to your client onboarding and your sub-processor change notices, and review both at least once a year. Article 30(4) requires both to be made available to the supervisory authority on request.
Yes. Article 30 of the UK GDPR has the same two records with the same contents, and the ICO publishes documentation templates for controllers and for processors.
Yes, on separate sheets or clearly separated sections. The contents differ, so mixing them in one table leaves empty columns and confuses readers.
The Article 30(5) exemption applies to processors too, on the same conditions. Processing for clients is usually regular rather than occasional, so the exemption rarely applies.
The processor. Article 30(2) is the processor’s own obligation, and breaches of Article 30 fall under the fines in Article 83(4).
Our free ROPA template keeps the controller and processor records side by side and flags missing contents in each, and our ROPA example shows both filled in for one company. For contracts with your clients and sub-processors, see the GDPR data processing agreement guide and the GDPR Toolkit.
September 30, 2026
