ROPA (record of processing activities)
Record of processing activities under Art. 30 GDPR — mandatory for almost all controllers
TL;DR
The record of processing activities (ROPA) is a register maintained under Art. 30 GDPR of all processing activities of a controller or processor. For controllers it contains 7 mandatory items under Art. 30(1)(a)–(g) GDPR (for example purposes, categories of data, recipients, erasure periods) plus 2 practical fields, and must be made available to the supervisory authority on request.
What is a ROPA (record of processing activities)?
The ROPA (also called the processing register) is mandatory under Art. 30(1) GDPR for all controllers — the exemption for undertakings with fewer than 250 employees set out in Art. 30(5) almost never applies in practice, because it excludes routine processing such as HR data, customer CRM or newsletters.
Processors maintain their own ROPA under Art. 30(2) with different mandatory fields. The ROPA must be made available to the supervisory authority on request (Art. 30(4) GDPR); in practical experience, a request to produce the ROPA often comes first in supervisory enquiries.
Example from practice
A 30-person mechanical engineering company documents its processing activities in the ROPA:
- Payroll (with the tax adviser as an independent controller)
- CRM customer master data (in-house database)
- Application management (e-recruiting SaaS)
- Video surveillance of the production hall
- Newsletter distribution (Cleverreach)
For each entry, 7 mandatory items under Art. 30(1)(a)–(g) GDPR are documented — controller, purpose, categories of data subjects and data, recipients, third-country transfer, erasure periods, reference to the technical and organisational measures — plus 2 practical fields: legal basis and processor (where relevant).
Legal position: Germany and Austria
Art. 30 GDPR is directly applicable EU law and is identical in wording in Germany and Austria: structure, mandatory fields, the processor's own ROPA (paragraph 2) and the exemption for undertakings with fewer than 250 employees (paragraph 5) are the same. Differences only arise in the national special legislation that supplies the legal basis to be entered in the ROPA, and in the competent supervisory authority.
- Germany: For the processing of employee data (including health data under Art. 9), the legal basis stated in the ROPA is as a rule § 26 BDSG (German Federal Data Protection Act; data processing for the purposes of the employment relationship). The competent supervisory authorities are the Länder data protection authorities for non-public bodies (§ 40 BDSG) and the Federal Commissioner for Data Protection (BfDI) for federal bodies (§ 9 BDSG).
- Austria: There is no § 26 BDSG there. The processing of employee and health data is based on Art. 9(2)(b) or Art. 88 GDPR in conjunction with § 96(1) no. 3 of the Austrian Labour Constitution Act (ArbVG) and the Austrian Data Protection Act (DSG). The competent supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde, DSB) under § 18 DSG.