Record of Processing (ROPA) Generator

About the Record of Processing (ROPA) Generator

Every controller and processor under the GDPR keeps a record of processing activities — a register of what personal data it processes, why, about whom, who receives it, where it goes and for how long (Article 30). Supervisory authorities can ask to see it at any time, and it is the starting point for privacy notices, DPIAs and data subject requests.

Add one card per activity — or start from common ones such as payroll, recruitment, customer orders, marketing e-mails, analytics and CCTV, or import a CSV, including one made from the ICO’s documentation template. For a controller each card holds the items of Article 30(1) — purposes, data subjects, personal data, recipients, transfers and their safeguards, retention and security — plus what the ICO recommends recording besides: the lawful basis, the condition for special category data, the source, the location and whether a DPIA is needed. For a processor it holds the items of Article 30(2). The register builds itself as a table under the form and as a document to print, with an index and one section per activity; the checks flag what Article 30 still needs. The free preview shows the register’s pages marked; a Premium pass unlocks the DOCX, PDF, print, copy and the CSV export.

Common uses

• A small business putting its first record of processing in writing.
• A DPO moving a register from spreadsheets into a printable document and back.
• A processor — a payroll bureau, an IT provider — keeping its Article 30(2) record per client.
• Preparing for an inspection, an audit or a customer’s due-diligence questionnaire.

What Article 30 requires

• Controllers (30(1)): the name and contact details of the controller and of any joint controller, representative and data protection officer; the purposes; the categories of data subjects and of personal data; the categories of recipients, including in other countries; transfers to third countries or international organisations, with the documentation of safeguards for transfers under the second subparagraph of Article 49(1); and, where possible, time limits for erasure and a general description of the security measures.
• Processors (30(2)): the name and contact details of the processor and of each controller it acts for (and any representative and DPO); the categories of processing for each controller; transfers and their safeguards; and, where possible, the security measures.
• The record is in writing, which includes electronic form, and is made available to the supervisory authority on request (Article 30(3) and (4)).

Fewer than 250 employees

Article 30(5) lifts the duty for an organisation with fewer than 250 employees — but not for processing that is likely to result in a risk, that is not occasional, or that includes special category or criminal data. Payroll, staff records and customer records are not occasional, so in practice small organisations keep a record of them too.

What else is worth recording

The ICO suggests keeping, beside the Article 30 items, the lawful basis of each activity and any legitimate interests, the rights people have, any automated decision-making, the source of data not collected from the person, where consents are recorded, the processor contracts, the location of the data, links to DPIAs and to records of breaches, and — for special category data under the UK’s Data Protection Act 2018 — the condition relied on. The register has columns for the lawful basis, the Article 9 condition, the source, the location and the DPIA.

CSV import and export

Import a CSV whose first row names the columns: the register’s own headings, common alternatives and the headings of the ICO’s templates are recognised, lawful bases written as “6(1)(b)” or in words are read, and unknown columns are reported. The file is read in your browser and never uploaded. The export writes the register with the same headings, UTF-8 so accents survive, and with a protective apostrophe before any cell that starts like a spreadsheet formula.

Official sources

• Regulation (EU) 2016/679 (GDPR) — Article 30
• ICO: what do we need to document under Article 30?
• ICO: should we document anything else?
• ICO: how do we document our processing activities?

Limitations

• A structured template, not legal advice: the entries must match your real processing, and the common activities are only a starting point.
• Retention periods depend on each country’s tax, employment and company laws, so no common activity sets one: take them from your retention schedule.
• It records what you enter and checks it against Article 30; it does not discover processing in your systems.
• The CSV import reads the first worksheet saved as CSV; save an Excel workbook as CSV first.

Privacy

On this device; its files download once

Everything happens in your browser. Your register and any CSV you import are not uploaded or stored by MySmartCoPilot. If you tick Keep a draft in this browser, the form is saved in this browser’s local storage until you untick it.