# Record of processing activities (ROPA): build yours in an afternoon (template included)
URL: https://pulsaiq.com/en/guides/record-of-processing-activities/
Last reviewed: 2026-10-23
Language: en
Legal basis: GDPR Art. 30
Almost every organisation needs one, and almost nobody enjoys writing it. This guide gives you a simple method to finish a usable record of processing activities (ROPA) by the end of the day, with worked examples and every rule linked to its source.
## In two minutes
- **What it is:** a written list of what your organisation does with personal data. For each activity, it says why, whose data, who receives it, how long you keep it and how you protect it. Art. 30(1)
- **Who needs one:** controllers and processors. It can be electronic, and you must hand it to your supervisory authority if asked. Art. 30(2)–(4)
- **"We have fewer than 250 staff, so we're exempt"** is rarely true. Running payroll every month already makes the processing "not occasional". Portugal's authority, the CNPD, says the exemption applies only in "absolutely exceptional" circumstances.
- **How to do it fast:** one row per purpose (not per software tool), five questions for each team, and a few extra columns that make the record useful. For a typical SME, it fits in an afternoon.
- **What may change:** the EU is finalising a deal to extend the exemption to organisations with fewer than 1,000 people, except for high-risk activities. It is not law yet. See the [box on upcoming changes](#the-exemption-is-set-to-widen-it-isnt-law-yet).
### Who this is for
SME managers who "also do GDPR", and DPOs or consultants who build records for clients and want a repeatable method. If you look after several clients, see also the guide for external DPOs with several clients.
### Who it isn't for
Anyone who needs legal advice on a specific case. This guide explains the rule and a practical method. It doesn't replace professional advice. If you're in the UK, the UK GDPR and the ICO's guidance apply instead.
Friday, 2:05 pm, Oficina Rocha
Marta is the office manager at Oficina Rocha, a 45-person furniture maker near Braga, in northern Portugal, with an online shop that ships across the country. On Friday afternoons, she "also does GDPR".
Today an email arrived from the CNPD, the Portuguese data protection authority. An online customer has filed a complaint, and the authority is asking for several documents, including the company's record of processing activities.
Marta opens the shared drive and finds *GDPR_final_v3.docx*, dated May 2018. It mentions a server that no longer exists, a software vendor that has since changed its name, and a fax machine. It says nothing about the online shop, the warehouse cameras or the new recruitment software.
She has until the end of the afternoon to work out what's missing. Let's do it with her.
Oficina Rocha, Marta and the other characters are fictional.
## What the record is, and why it's worth having
The record is a map of your organisation's personal data. It isn't a legal text or a policy. It's a table with one row per activity: running payroll, hiring, handling online orders, sending the newsletter, recording CCTV footage.
The law requires it so that you can show you comply with the GDPR, and so that the supervisory authority can check it Recital 82; Art. 5(2); Art. 30(4). But the biggest benefit is internal. An up-to-date record quickly answers the questions that always come up at the worst moment:
- **A customer asks for all the data we hold on them.** The record tells you where to look (see the guide to access and erasure requests). In its 2024 coordinated action on the right of access, which covered 1,185 organisations, the European Data Protection Board (EDPB) recommends using the record to locate the data and identify who received it.
- **We lost a laptop.** The record tells you what data could have been on it and who is affected, the first question in the 72 hours after a data breach.
- **We're switching software vendors.** The record tells you which activities depend on it.
- **We need to update our privacy notice.** The purposes, recipients and retention periods are already written down Arts. 13 and 14.
## "We have fewer than 250 employees, so we're exempt." Probably not.
The GDPR does have an exemption for organisations with fewer than 250 employees. But read the sentence to the end:
"The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10."GDPR, Art. 30(5)
Any one of the three conditions cancels the exemption, and the second catches almost everyone: payroll every month is not occasional. That's why the CNPD describes the circumstances in which the exemption applies as **"absolutely exceptional"**.
The Article 29 Working Party, whose position paper the EDPB has endorsed, made one useful clarification: a small organisation only has to record the activities that meet one of the conditions. In practice, as Oficina Rocha shows, that's nearly all of them.
Oficina Rocha activity
Not occasional?
Could pose a risk?
Special or criminal data?
In the record?
**Payroll**
Yes, monthly
Low
Yes, sick notes
Yes
**Warehouse CCTV**
Yes, continuous
Yes
No
Yes
**Online shop orders**
Yes, daily
Low
No
Yes
**Recruitment**
Yes, several times a year
Low
Usually not
Yes
**Guest list for the company's 50th anniversary party**
No, a one-off
Low
No
Can be left out
Illustrative example. The risk assessment depends on each organisation's actual circumstances.
Even where the exemption applies, the record is still the simplest way to meet the accountability principle Art. 5(2); Art. 24. In 2025 the EDPB and the European Data Protection Supervisor called it "a useful tool to support compliance with other duties, such as the one of transparency".
## Controller or processor? Maybe both
There are two different records, with different contents.
| | Controller record | Processor record |
|--------------|----------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| **When** | You decide why and how the data is processed | You process data on behalf of another organisation |
| **Contents** | The seven fields in Art. 30(1) (below) | The clients you act for, the kinds of processing you carry out for each, transfers outside the EEA, and security measures Art. 30(2) |
| **Example** | Oficina Rocha, for its own staff's payroll | The accountancy firm that runs that payroll |
One organisation can be both. A marketing agency is a controller for its own staff data, and a processor when it sends newsletters to its clients' mailing lists. The CNPD is clear that an organisation acting in both roles keeps **two separate records**. The EDPB's Guidelines 07/2020 help you decide which role applies in each case.
## The seven fields, in plain English
This is the minimum content of a controller's record Art. 30(1)(a)–(g). The last column shows Oficina Rocha's payroll row as a worked example.
| Field | What it means | Example: payroll |
|-----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **(a) Who you are** | Name and contact details of the organisation and, where they exist, any joint controller, EU representative and data protection officer (DPO) | Oficina Rocha, Lda., Braga. Contact: privacy@… DPO: none appointed |
| **(b) Why** | The purpose, in one concrete sentence | Pay salaries and meet tax and social security obligations for employees |
| **(c) Whose data, and what data** | Categories of data subjects and categories of personal data | Current and former employees. Identity details, tax and social security numbers, bank details, pay, absences, family details for income tax, sick notes (health data) |
| **(d) Who receives it** | Categories of recipients, including any outside the EU | Accountancy firm (processor), tax authority, social security, bank, workplace accident insurer |
| **(e) Does it leave the EEA?** | Transfers outside the EEA and the safeguards used | No. Payroll software hosted in the EU (confirmed in the contract) |
| **(f) How long** | Time limits for erasure, where possible | For the period required by the applicable tax and employment law, stated in years, then deleted. Never "indefinitely" |
| **(g) How it's protected** | A general description of security measures Art. 32(1) | Access for two people only, two-factor authentication, encrypted backups, processor contract with the accountancy firm Art. 28 |
**On retention periods.** In field (f), write the number of years and the reason (for example, "tax law"). If you don't know the exact period, ask your accountant or lawyer, and note who confirmed it and when. A checked period is better than a perfect one.
## The afternoon method
Marta doesn't need a three-month project. She needs an honest, complete record today, which she can improve later. For an organisation with 10 to 20 activities, these four steps fit in one afternoon. In a larger organisation, plan one afternoon per department.
1. 2:00 pm · 30 min
### List your teams and systems
Write down the organisation's areas: HR, sales and the online shop, finance, production, IT, facilities. Next to each, list the software and services it uses. Don't forget the website: forms, cookies and analytics tools process personal data too.
2. 2:30 pm · 90 min
### Ask each team the same five questions
Fifteen minutes per person is enough. Always use the same questions:
1. What personal data do you use in your work?
2. What do you use it for?
3. Where does it come from (the person, another company, a public list)?
4. Who else sees or receives it, including software and service providers?
5. How long is it kept, and why?
3. 4:00 pm · 90 min
### Write one row per purpose, not per software tool
This step prevents more mistakes than any other. France's data protection authority, the CNIL, says it directly: identify activities by purpose, not by the software used. One tool can serve several purposes, and one purpose almost always uses several tools.
\[Diagram: the purpose "Handle online shop orders" connects to four systems: shop platform, invoicing software, delivery company, customer support inbox.\]
Systems go in their own column in the row. Change delivery company, and you change one cell, not the whole record.
4. 5:30 pm · 30 min
### Add the columns that make the record useful
Article 30 doesn't require them, but they save work later. The CNIL also recommends adding fields to its basic template.
- **Lawful basis** (contract, legal obligation, consent…) Art. 6
- **Source of the data**, needed for privacy notices Art. 14
- **Systems and vendors**, noting whether a processor contract is in place Art. 28
- **DPIA needed?** Yes, no or to check Art. 35
- **Row owner** and **next review date**
By 6 pm, Marta has 14 rows. Three are marked "to confirm". It isn't perfect, but it's true, it's dated and it can be sent. It's far better than the 2018 file.
## Six mistakes that make a record useless
- **One row per software tool.**"HR software" isn't a purpose. Hiring, payroll and performance reviews are three.
- **Vague purposes.**"Management" or "administrative purposes" says nothing. Write what actually happens: "send the monthly newsletter to customers who asked for it".
- **"Indefinite" retention.** The GDPR asks for time limits wherever possible. It's almost always possible to give a number.
- **Forgotten activities.** The ones most often missing: CCTV, unsolicited job applications, website analytics, and the IT contractor's remote access.
- **Incomplete recipients.** Your email provider, cloud host and accountancy firm are recipients too.
- **Nobody owns it.** A record with nobody responsible for updating it goes stale in months. Give each row to a person.
## What the authorities say
There hasn't (yet) been an EU-wide coordinated action on records of processing, but the authorities have been consistent:
- **The CNPD** stresses that the obligation also covers organisations with fewer than 250 employees and that the exemption is "absolutely exceptional". It publishes Excel templates for controllers and processors.
- **The EDPB**, in its 2024 report on the right of access, says the record "should be kept up to date at all times", including when new IT systems or processors come in, and recommends using it to find data when a request arrives.
- **The EDPB and the EDPS** acknowledged in 2025 that the current exemption "did not always achieve its goal". They supported simplification, while still calling the record a useful tool.
- **In the EDPB's 2025 public consultation** on templates, the record of processing topped the list of most-wanted templates. The EDPB has put an EU template for records in its 2026–2027 work programme. If you find the record hard, you're not alone.
## The exemption is set to widen. It isn't law yet.
In May 2025, the European Commission proposed amending Article 30(5) as part of its "Omnibus IV" simplification package. The legislative procedure is 2025/0130(COD).
- 21 May 2025Commission proposal: exemption for organisations with fewer than 750 employees, unless the processing is likely to result in a high risk.
- 25 Feb 2026European Parliament committees adopt their position: a 1,000-employee threshold, and no exemption for processing sensitive data.
- 26 Jun 2026Provisional agreement between Parliament and Council, confirmed by the Committee of Permanent Representatives.
- 23 Nov 2026Indicative date for Parliament's plenary vote. Council adoption and publication in the Official Journal follow.
**The compromise text** (Council document 10482/26 ADD 3, 19 June 2026) would lift the record-keeping obligations for enterprises and organisations with **fewer than 1,000 people**, with three limits:
- you must still record any activity that is **likely to result in a high risk** to individuals, in the sense of Article 35, and only that activity;
- you must still keep records where the activity is one that **requires a DPO**;
- the exemption does not cover **public authorities and bodies**.
The recitals add that processing health data only to meet employment and social security obligations (sick notes, for example) does not, on its own, require a record.
**What this means for you today:** until the final text is published in the Official Journal and starts to apply, the current 250-employee rule stands. And even afterwards, an exempt organisation still needs to know what data it holds to answer access requests, handle data breaches and write accurate privacy notices. Being exempt from the format doesn't exempt you from the knowledge.
A separate package, the "Digital Omnibus" of November 2025, does not change Article 30, but it proposes EU-wide lists of processing that requires a DPIA. If adopted, it will help with the "DPIA needed?" column. We review this box at each stage of the procedure. What that proposal changes for data breaches and access requests is in our article on the Digital Omnibus.
## Keep it alive in 15 minutes a quarter
A record is a snapshot. To stop it going stale, it needs triggers and a short routine.
| When | What to do |
|------------------------------------------|----------------------------------------------------------------------------------------------------------------|
| **New vendor or software** | Add it to the systems and recipients of the affected rows. Check the Art. 28 contract. |
| **New project, product or website form** | Create the row before you start collecting data. Check whether a DPIA is needed. |
| **Someone leaves or changes role** | Hand their rows to a new owner. |
| **Once a quarter** | Each owner reviews their rows: is it still true? Are retention periods being followed? Update the review date. |
## Free templates, compared honestly
You don't have to start from scratch. These are the official templates available:
| Template | Good for | Limits |
|--------------------------------------------|--------------------------------------------|-----------------------------------------------------------------|
| **ICO** (UK, controller and processor) | Clear step-by-step guidance in English | Written for the UK GDPR |
| **CNIL** (simplified model, .ods) | Designed for SMEs and associations, simple | In French |
| **CNPD** (Excel, controller and processor) | Follows Art. 30 closely | In Portuguese, and blank. Little guidance on filling each field |
| **EDPB** (EU template) | Will be harmonised across the EU | Planned in the 2026–2027 work programme, not yet published |
The Pulsaiq kit follows the same rules and adds what's missing: rows already written for activities almost every SME has, and a short explanation for each column.
## Checklist: is your record ready?
- You've decided whether you're a controller, a processor or both, and you have a record for each role.
- You've spoken to every team, including IT and whoever runs the website.
- Each row is one purpose, written as a concrete action.
- The seven Art. 30(1) fields are filled in for every row.
- Every retention period has a number and a reason.
- Software and service providers appear as recipients.
- Transfers outside the EEA are identified, with the safeguard used.
- Activities that may need a DPIA are flagged.
- Each row has an owner and a next review date.
- The record is dated and could be sent to the supervisory authority the same day it's requested.
## Frequently asked questions
### Does an SME with fewer than 250 employees need a record of processing activities?
Almost always, yes. The Art. 30(5) exemption stops applying if the processing is not occasional, may result in a risk, or includes special category or criminal data. Running payroll every month is not occasional, and the Portuguese authority considers the exemption applies only in "absolutely exceptional" circumstances.
### Do I have to send the record to the supervisory authority?
No. The record stays with the organisation, in writing, and it can be electronic (Art. 30(3)). You only have to hand it over when the authority asks for it (Art. 30(4)), so keep it ready to send the same day.
### Can a spreadsheet be the record?
Yes. The law sets no format or software, only the content of the seven fields. Several authorities publish their own templates as spreadsheets. What matters is that the record is complete, dated and up to date.
### How often should I update the record?
Whenever something changes, plus a short review every quarter. The law sets no frequency, but the EDPB recommends keeping the record "always up to date", including when new systems or processors come in.
### Does the Omnibus IV proposal already exempt me from the record?
Not yet. Until the final text is published in the Official Journal and applies, the current 250-employee rule stands. The provisional agreement of 26 June 2026 exempts organisations with fewer than 1,000 people, but keeps the record for high-risk activities.
## Sources
### Legislation
- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Articles 5, 6, 13, 14, 24, 28, 30, 32, 35 and Recital 82, EUR-Lex
### Supervisory authorities
- [Article 29 Working Party, Position Paper on Article 30(5)](https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=624045), 19 Apr 2018, endorsed by the EDPB
- [EDPB, 2024 coordinated enforcement report on the right of access](https://www.edpb.europa.eu/system/files/2025-01/edpb_cef-report-2024_20250116_rightofaccess_en.pdf), Jan 2025
- [EDPB, Guidelines 07/2020 on the concepts of controller and processor](https://www.edpb.europa.eu/system/files/documents/2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf)
- [EDPB, report on the public consultation on templates](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_report_20260211_publicconsultationonhelpfultemplates_en_0.pdf), 2026
- [EDPB, Data protection guide for small business](https://www.edpb.europa.eu/sme/be-compliant/be-compliant_en)
- [ICO, How do we document our processing activities?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/how-do-we-document-our-processing-activities/)
- [CNPD, Registo de atividades de tratamento](https://www.cnpd.pt/organizacoes/outras-obrigacoes/registo-de-atividades-de-tratamento/) (in Portuguese), with templates for controllers and processors
- [CNIL, Le registre des activités de traitement](https://www.cnil.fr/fr/RGPD-le-registre-des-activites-de-traitement) (in French)
### Changes in progress
- [European Commission, COM(2025) 501](https://commission.europa.eu/document/download/7fd9c846-b894-4f9f-b164-3b926d1b264b_en?filename=Proposal+GDPR+Omnibus.pdf), proposal amending the GDPR
- [European Parliament, procedure file 2025/0130(COD)](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025%2F0130%28COD%29)
- [European Parliament, press release on the committee vote](https://www.europarl.europa.eu/news/en/press-room/20260220IPR35906/simplified-rules-for-small-mid-cap-companies), Feb 2026
- [Council of the EU, document 10482/26 ADD 3](https://data.consilium.europa.eu/doc/document/ST-10482-2026-ADD-3/en/pdf), compromise text, 19 Jun 2026
- [EDPB and EDPS, Joint Opinion 01/2025](https://www.edpb.europa.eu/news/news/2025/targeted-modifications-gdpr-edpb-edps-welcome-simplification-record-keeping_en), Jul 2025
- [EDPB and EDPS, Joint Opinion 2/2026 on the Digital Omnibus](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf)
**Last reviewed:** 21 October 2026. We review this guide whenever the law or the authorities' guidance changes.
This guide is general information about the GDPR and is not legal advice. For decisions on a specific case, consult a qualified professional. The characters and companies in the examples are fictional.