Records of Processing Activities (RoPA): what it is and how to fill it in

What are the Records of Processing Activities?

In 2018 the GDPR replaced the old system of notifying data files to the national data protection authority, as Spain did with its AEPD. Instead of giving the authority a list to approve, the GDPR turned the model around: each organisation now has to document internally, on its own initiative and under the accountability principle, every processing of personal data it carries out: what it does with the data, for what purpose, about whom and for how long.

It is not a form you file and forget. It is a living document: every time a new processing activity starts (a marketing campaign, a new payroll provider, a chatbot that collects customer data) it has to be added to the records before the processing begins, not afterwards.

Who has to keep it?

The general rule is simple: every controller and processor must keep records, whatever the size of the company. There is an exception for organisations with fewer than 250 employees, but it only applies if all three conditions are met at once:

The processing is occasional (not a regular part of the business).
It does not include special categories of data (health, ethnic origin, trade union membership, biometric data and so on) or data on criminal convictions and offences.
It does not pose a risk to the rights and freedoms of the people concerned.

In practice, almost no small company meets all three: running employee payroll, a customer base or a CRM stops being “occasional” as soon as it becomes a regular part of the business. That is why authorities such as Spain’s AEPD recommend that, except in very specific one-off cases, every organisation keeps its records.

What the controller’s records must include (Art. 30(1))

For each processing activity, the controller’s records must cover:

Name and contact details of the controller (and of any joint controller, representative or DPO).
The purposes of the processing: precisely what the data is used for.
A description of the categories of data subjects (employees, customers, candidates...) and the categories of personal data processed.
The categories of recipients the data is disclosed to, including transfers to third countries or international organisations.
The envisaged time limits for erasure of the different categories of data, where possible.
A general description of the technical and organisational security measures in place.

The processor’s records are different (Art. 30(2))

If your company processes data on behalf of another (for example, you are an accounting firm, a SaaS platform or a provider that handles your clients’ data), the GDPR requires a second, separate record with different content: your name and contact details, those of each controller you act for, the categories of processing you carry out for each of them, any international transfers, and a general description of your security measures. You don’t need to set out the purposes: that responsibility lies with the controller, not with you.

It is common for the same company to need both records at once: one as controller of its own employees’ and customers’ data, and another as processor of the data it handles for third parties.

Why it matters more than it seems: it is the documentary foundation of data protection compliance. Without complete, up-to-date records there is no basis to justify almost any of the other GDPR obligations: it is usually one of the first documents requested in an inspection.

Free template vs. a template with worked examples

Free official templates exist (several authorities, such as the AEPD, publish guidance models), and they are a good starting point if you have never done records before. The problem is usually not the template itself but the blank page: most of these templates give you the column structure but no example of how to word the “purposes of processing” or the “categories of data” for real cases such as payroll, CCTV or a sales CRM, and that is where most time is lost and most mistakes are made.

The most common mistakes when filling in the records

Purposes that are too generic. Writing “customer management” is not enough; billing, marketing, support and loyalty should be listed as separate processing activities if they have different legal bases.
Forgetting international transfers. Using a CRM, ERP or email marketing tool hosted outside the EU (including the US) is an international transfer that the records must reflect, with the corresponding safeguard.
Not updating it when you change provider. The records are a living document: switching payroll tool or CRM without updating them is one of the most common failings found in inspections.
Mixing up the controller’s and the processor’s records. They are two separate documents with different content: filling in only one is not enough when the company plays both roles.
Leaving out erasure time limits. It is often left blank because “we don’t know”, but the GDPR asks for at least an estimate, not an exact date.

The records are not the most eye-catching compliance document, but they hold up all the others: without them, it is hard to justify the rest of your data protection policies when someone asks.

Related: where the GDPR and the AI Act overlap and what an AESIA or AEPD inspection will ask for first.