Record of processing activities: how to keep an Article 30 register that you will actually use

7 min read · Updated 2026-11-12

Article 30 of the GDPR requires a record of processing activities (often called a RoPA, or in Dutch a register van verwerkingsactiviteiten). It is the working list of what you do with personal data. If it is accurate, everything else (the notice, the agreements, the answers to requests) becomes easier. If it is a one-off spreadsheet you never open again, it will not help you.

Who must keep a record

Controllers and processors each have a record duty, with slightly different content. There is an exemption for organisations with fewer than 250 employees, but it is narrow. You still need a record for processing that is not occasional, that is likely to result in a risk to people, or that involves special categories or criminal data (Article 30(5)). A typical startup product that stores user accounts on an ongoing basis is not 'occasional'. Plan to keep a record.

What to write down

For a controller, Article 30(1) asks for: your name and contact details (and of the DPO, if you have one); the purposes; the categories of data subjects and of personal data; the categories of recipients; transfers to a third country and the transfer tool; envisaged time limits for erasure where possible; and a general description of security measures where possible. Processors keep a similar record of the processing they do on behalf of each controller (Article 30(2)).

Write it in language your team understands. One row per purpose is clearer than one row per tool. Name the vendors under recipients, and point to the Article 28 agreement and the transfer tool for each. Update the row when you add a tool, change a purpose, or close a product feature.

How to keep it alive

Review the record when you onboard a vendor, launch a feature, or run a data protection impact assessment (Article 35). Use it when you answer an access request, so you do not search from scratch. If the AP asks to see it, you must make it available (Article 30(4)).

A branded report is not the record, but a good assessment will tell you where the record is thin. DPOne's onboarding and reports are built to feed that work, not to replace the record you are responsible for keeping.

Frequently asked questions

In what language should the record be kept?

The GDPR does not fix a language. Keep it in a language your team and, if needed, the AP can work with. For a Dutch company, Dutch or English is usual. If you operate in more than one language, be consistent and accurate.

Is a DPIA the same as a record of processing?

No. A data protection impact assessment under Article 35 is a deeper analysis for high-risk processing. The record is the inventory. You often need both, and the record is an input to the DPIA.