UK GDPR · EU GDPR · Article 30
Records of Processing Activities (ROPA)
We prepare and maintain the Article 30 records that regulators ask for first. They give you a complete map of the personal data your business holds, why you hold it, and where it goes.
The Legal Requirement
The Document Regulators Ask for First
Article 30 of the UK GDPR and the EU GDPR requires controllers and processors to keep written records of their processing activities. If the ICO or an EU authority opens an enquiry, these records are usually the first document requested. Where you have appointed a UK or EU representative, the representative must also hold a copy and be able to produce it on request.
There is a limited exemption for organisations with fewer than 250 employees. It does not apply if the processing is more than occasional, is likely to result in a risk to individuals, or includes special category or criminal-offence data. Most online businesses process customer data continuously, so in practice the exemption rarely helps.
Good records are also the foundation for everything else. Privacy notices, retention schedules, transfer assessments and breach responses all depend on knowing what data you hold.
- 01
Controller Records
Purposes, categories of data and individuals, recipients, transfers, retention and security measures (Article 30(1)).
- 02
Processor Records
The clients you act for, the categories of processing, transfers and security measures (Article 30(2)).
- 03
Available on Request
Records must be in writing, including electronic form, and provided to the regulator on request.
- 04
Kept Up to Date
The records must reflect current processing, not a one-off snapshot.
Our Service
What We Prepare
A practical register built around how your business actually works, in a format your team can maintain.
Data Mapping Workshops
Short structured interviews with your teams (sales, marketing, HR, IT, customer service) to identify every processing activity.
Controller & Processor Records
A complete Article 30 register in a clear spreadsheet format that you own and can update.
Lawful Basis Analysis
The lawful basis for each activity, including legitimate interests assessments where needed.
Retention Schedule
How long each category of data should be kept, and why.
Transfer Mapping
Which data leaves the UK or EU, to which countries and providers, and under which transfer mechanism.
Annual Review
An optional yearly update so the records stay accurate as your business changes.
Beyond Compliance
Why Good Records Pay Off
Faster Regulator Responses
You can answer an enquiry in days, not weeks.
Accurate Privacy Notices
Your notice describes what you really do, which reduces complaint risk.
Smoother Due Diligence
Investors, acquirers and enterprise customers increasingly ask for data protection records.
Better Security Decisions
Knowing where data sits shows where protection is needed most.
How It Works
Four Steps to Complete Records
Scoping Call
We identify your departments, systems and main data flows.
Data Mapping
Short interviews and a questionnaire for each team.
Draft Records
You receive the draft register with questions and recommendations.
Final Register
The agreed records, ready to share with your representative or a regulator.
Common Questions
Records of Processing — FAQ
Get Started
Know What Data You Hold
A complete, accurate record of processing is the first step to compliance and the first document a regulator will ask for.
Build Your RecordsOr contact us directly: +44 7368 955207 · a.moini@padinternationalgroup.com