Guide · GDPR
What goes in a record of processing activities? GDPR Article 30
A record of processing activities (RoPA) is the written inventory GDPR Article 30 requires, and it holds seven items for a controller and four for a processor. Organisations with fewer than 250 staff are exempt only when none of three conditions in Article 30(5) applies, and one of them, processing that is not occasional, covers most routine work.
Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:
The figure behind it
GDPR Article 30 sets 7 required items for a controller's record and 4 for a processor's, and exempts organisations with fewer than 250 staff only when none of 3 conditions applies. Source: Regulation (EU) 2016/679, Article 30(1), (2) and (5), EUR-Lex text as held by Rekvira (corpus of 2 September 2026)
Everything quoted below came back from Rekvira's tools on 24 September 2026, from the EUR-Lex text of the GDPR (Regulation (EU) 2016/679). The UK GDPR keeps the same article numbers.
What is a RoPA for?
It is the evidence of what you process and why. Article 5(2) says the controller "shall be responsible for, and be able to demonstrate compliance with" the processing principles, and Recital 82 says each controller and processor should make the records available on request "so that it might serve for monitoring those processing operations".
What must the record contain?
Article 30 has five paragraphs. The first two set the content, and the lists are different for the two roles. A processor does not repeat the controller's purposes; it records the categories of processing it carries out for each controller.
| Item | Controller, Article 30(1) | Processor, Article 30(2) |
|---|---|---|
| Identity | (a) name and contact details of the controller, any joint controller, representative and DPO | (a) name and contact details of the processor, of each controller it acts for, representatives and the DPO |
| What is done | (b) the purposes of the processing | (b) the categories of processing carried out on behalf of each controller |
| Whose data | (c) categories of data subjects and categories of personal data | not required |
| Recipients | (d) categories of recipients, including in third countries | not required |
| Transfers | (e) transfers to a third country or international organisation, with safeguards documentation for Article 49(1) second-subparagraph transfers | (c) the same, where applicable |
| Retention | (f) "where possible, the envisaged time limits for erasure" | not required |
| Security | (g) "where possible, a general description of the technical and organisational security measures" | (d) the same, where possible |
read_unit call below. Wording in quotes is the article's; the rest is our summary of each point.Two items carry "where possible": erasure time limits and the security description. The rest are unconditional ("shall contain all of the following information"). A record without purposes or recipients is incomplete under the article, whatever format it is in.
Who has to keep a record?
Both roles. Article 30(1) addresses "each controller and, where applicable, the controller's representative"; Article 30(2) addresses "each processor". Under Article 30(4) either of them "shall make the record available to the supervisory authority on request".
If you are the processor, the record goes hand in hand with your contracts: each controller named in the record should also appear in a data processing agreement. What a data processing agreement must contain covers that side.
Does the 250-employee exemption apply to you?
Read the whole sentence before relying on it:
"The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10." (Article 30(5))
The exemption has three exits, joined by "or", so any one of them brings the duty back:
- The processing is likely to result in a risk to data subjects. The threshold here is "a risk", lower than the "high risk" that triggers a DPIA under Article 35.
- The processing is not occasional. Anything done every week or every month, such as payroll or a customer list, is on its face not occasional.
- The processing includes special-category data (Article 9(1)) or criminal-offence data (Article 10).
On a plain reading, the exemption rarely covers everything an organisation processes. The exemption is also for the record only: it does not remove any other GDPR duty.
7
items in a controller's record, Article 30(1)(a) to (g)
4
items in a processor's record, Article 30(2)(a) to (d)
3
conditions, any one of which ends the under-250 exemption
read_unit on 24 September 2026.How does the record connect to a DPIA?
The record is where screening starts. Its items (a) to (g) are most of what Article 35(7)(a) asks for, "a systematic description of the envisaged processing operations and the purposes of the processing". When a new line in the record looks like one of the three cases of Article 35(3), that line needs an assessment. When is a DPIA required? sets out those cases.
Recorded run
The question:What must a record of processing activities contain, and who has to keep one?
search_regulation(regulation="gdpr", query="record of processing activities")Let the corpus rank the passages for the reader's own question.
"Article 30(1)" and "Article 30(2)" ranked first and second of 25 passages for "record of processing activities".
read_unit(regulation="gdpr", kind="article", number="30")Read Article 30 whole.
The whole article in 5 pinpointed paragraphs, including "shall be in writing, including in electronic form"
verify_citation(regulation="gdpr", citation="Article 30(5)", quote="shall not apply to an enterprise or an organisation employing fewer than 250 persons")Check the exemption wording before quoting it.
Quote found: the under-250 sentence quoted below is the held text of Article 30(5).
read_unit(regulation="gdpr", kind="recital", number="82")The recital behind the record.
"make those records, on request, available to it"
read_unit(regulation="gdpr", kind="article", number="5")Article 5(2) accountability, the duty the record evidences.
"The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1"
Real calls to Rekvira’s production server, captured 24 September 2026. Corpus as of 2 September 2026.
Limits
Rekvira returns the text of the Regulation with its pinpoint and the date of the text. It does not assess whether your record is complete or whether the exemption applies to you; that stays with you and your DPO. Supervisory authorities' templates and guidance are not in the corpus.
Do this in your assistant
Read GDPR Article 30 with Rekvira. I will paste one line of our record of processing activities.
Tell me which of Article 30(1) points (a) to (g) it covers and which are missing, quoting each point,
and whether any of the three conditions in Article 30(5) applies to it.Paste this into Claude, ChatGPT, Cursor or any MCP client connected to https://mcp.rekvira.com/mcp. Sign in once with your email to start (free).Install steps for each client
Start with a free account.
One email to sign in, no API key, and free during the beta.
https://mcp.rekvira.com/mcp