ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
A ROPA checklist is a list of checks to confirm that your record of processing activities contains everything GDPR Article 30 requires and that it is accurate enough to show a regulator. The record is one of the first documents a supervisory authority asks for, so gaps stand out quickly.
Many organizations build the register once in a spreadsheet and never look at it again. A checklist turns it into a maintained record by asking whether each required field is present, whether it matches reality and whether someone owns each line.
The checks below cover both controllers and processors. They are general guidance, so confirm national rules, especially on the small-organization exemption.
Free gap assessment
Could you demonstrate GDPR compliance today?
Score yourself against what a supervisory authority actually asks for, free — the records, not the policy.
Run the free GDPR gap assessment → or View premium report sample
Article 30 makes the record a legal duty for most organizations. It must be in writing, which includes electronic form, and it must be made available to the supervisory authority on request. A late or patchy record is a common finding in investigations.
The record is also the foundation for other privacy work. Your privacy notice, your DPIA screening, your breach response and your handling of data subject requests all depend on knowing what you process and where. A maintained record saves time on each of them.
The ROPA checklist below keeps the record honest. It checks for completeness, for accuracy and for ownership, which are the three places records usually fail.
Check one: have you decided whether you act as a controller, a processor or both for each activity? Many organizations are both, for example a software company that is a controller for its own staff and a processor for customer data. Each role needs its own record.
Check two: have you tested the small-organization exemption? Article 30(5) excuses organizations with fewer than 250 employees, but only if the processing is occasional, unlikely to result in a risk and does not include special category or criminal data. Since most organizations process employee or customer data regularly, the exemption rarely applies, which the ROPA exemption explains in more detail.
Check three: is one person accountable for the record? Name an owner, even if several teams supply content.
| Field | Controller (Art 30(1)) | Processor (Art 30(2)) |
|---|---|---|
| Identity | Controller and DPO contact | Processor, controllers and DPO contact |
| Purposes | Purposes of processing | Categories of processing per controller |
| Data | Data subjects and data categories | Not required as a list |
| Recipients | Categories of recipients | Not required as a list |
| Transfers | Third-country transfers and safeguards | Transfers and safeguards |
| Retention and security | Time limits and security, where possible | Security, where possible |
Free ROPA template and builder
Could you hand your records of processing to a regulator tomorrow?
Check whether Article 30 applies to you, add your processing activities from a library organized by department, complete every Article 30 content, and see which activities are missing a lawful basis, a transfer safeguard, a DPIA or an LIA. Free, with a record score and findings.
Check four: does each entry name the controller and, where applicable, the joint controller, the representative and the data protection officer? Check five: is the purpose stated clearly, using the language of your privacy notice? See ROPA purposes and lawful bases, and note that the lawful basis is not listed in Article 30 but is good practice to record.
Check six: are the categories of data subjects and categories of personal data specific, such as customers, employees and job applicants, and identifiers, financial data and location data? Check seven: are the recipients or categories of recipients named, including processors and other controllers?
Check eight: are transfers to third countries listed, with the safeguard used, as covered in ROPA international transfers? Joint arrangements are dealt with in ROPA joint controllers. The legal text is at GDPR Article 30 text.
Check nine: are retention periods stated for each category, where possible? Vague entries such as “as long as necessary” will not satisfy a reviewer. Examples are given in ROPA retention periods. Check ten: is a general description of technical and organizational security measures included? The approach in ROPA security measures shows how to keep this short without being empty.
Check eleven: if you are a processor, does your record list the controllers you act for, the categories of processing you carry out, any transfers and the security measures? Keep it separate from your controller record.
Employee data often hides in the gaps. ROPA HR processing lists typical HR activities that are easy to miss, such as recruitment, payroll, monitoring and benefits.
Check twelve: has each entry been validated by the business owner, not just the privacy team? A record written from memory tends to miss shadow systems and newer tools. Interview each department and compare the results with your system list and vendor list.
Check thirteen: does the record match your privacy notice and your contracts? If the notice says you keep data for two years and the record says five, one of them is wrong. Fix the inconsistency before a regulator finds it.
Check fourteen: is there a version history and a review date? The process in ROPA review process gives a simple quarterly or annual cycle, and ROPA tools versus spreadsheets helps you decide what to use.
Consider a mid-sized online retailer. The record has an entry for order fulfillment. Controller: the retailer, with a named privacy contact. Purpose: to process and deliver orders. Data subjects: customers. Data: name, address, email, order history, payment status. Recipients: a courier and a payment provider, both processors. Transfers: none. Retention: six years for accounting records. Security: access control, encryption and logging.
Running the ROPA checklist shows that the entry is complete for the required fields, and that one check fails: the owner column is empty. The fix is to name the head of operations as the owner and set a review date. The entry is invented for illustration, but the approach works for any activity.
Do this for every processing activity, then sort by risk to decide where to look first.
Article 30(4) requires you to make the record available to the supervisory authority on request. Prepare a simple procedure: who receives the request, who exports the record, who checks it and how long it takes. Practice once a year so nobody is surprised.
Check that the exported version is readable. A record that depends on a dozen linked sheets is hard to send. Keep a clean, versioned copy ready, and have a short cover note explaining how it is maintained. The guide in ROPA regulator request shows what to prepare.
A good record answers questions before they are asked. If the regulator can see it is complete, current and owned, the conversation usually moves on quickly.
The most frequent mistake is writing the record once for an audit and never touching it again. New tools, new vendors and new campaigns appear monthly, and each can create a processing activity that is missing from the register. Tie the record to change processes: procurement, project intake and release management should all ask whether the ROPA needs an update.
Another mistake is recording systems instead of activities. The record is about what you do with personal data and why, such as recruitment or customer support, not a list of software. A system can support several activities, and an activity can use several systems. A third mistake is using vague words, like “various” or “as needed”, which tell the regulator nothing. Use the ROPA checklist to replace each vague entry with a specific one.
Finally, avoid a record that nobody owns. Every line should have a named person who answers questions about it.
Book two-hour sessions with each department and bring the current record. Ask what data they collect, which tools they use and who they share it with. Compare the answers to the record and mark every difference. Update the entries the same day, while the conversation is fresh.
Afterwards, run the ROPA checklist across the whole record, noting the number of entries that pass every check. Report that percentage to management each quarter, and aim to raise it. A simple measure like this shows progress and keeps the record on the agenda.
You can build the register yourself, but the layout, the field definitions and the processor version take time to get right. A finished structure helps your team concentrate on the facts.
The ROPA Report provides an Article 30 record, a processor record and an Excel register, so each check above maps to a field you can fill in. Test it on one department before rolling it out.
Whichever approach you take, keep the ROPA checklist with the record, so the next reviewer can repeat the same checks without starting from scratch.
It is a record of processing activities, the written record that GDPR Article 30 requires controllers and processors to keep.
Usually yes. The exemption for organizations under 250 employees applies only to occasional, low-risk processing without special category data, which is rare.
Controllers must record purposes, categories of data subjects and data, recipients, transfers, retention periods where possible and security measures where possible.
Whenever you start, change or end a processing activity, and review it fully at least once a year.
The supervisory authority can request it at any time. There is no general duty to publish it.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026