GDPR ROPA completeness checker (Article 30)

Who is accountable: controller and contacts

Your organisation's identity and contact details as controller are recorded, along with any joint controllers and, where you are established outside the EU/EEA but caught by the GDPR, your appointed representative.

Data protection officer contact

Where you have appointed a DPO, their contact details are captured in the register so a supervisory authority or data subject can reach them.

Controllers you act for (processor records)

If you process personal data on someone else's behalf, your processor record lists your own name and contact details as processor, each controller you act for, and where applicable the processor's and each controller's representative and DPO. Skip if you only ever act as a controller.

Why each activity processes data

Each processing activity states the purpose it serves. As a processor, you instead record the categories of processing you carry out for each controller.

Lawful basis per activityRecommended

The Article 6 lawful basis for each activity (and the Article 9 condition where you handle special-category data) is noted. Article 30 does not strictly require this, but recording it makes the register far more useful and audit-ready.

Categories of people whose data you process

Each activity names the categories of data subjects involved, such as customers, employees, prospects, patients, or website visitors.

Categories of personal data

The categories of personal data processed in each activity are listed, such as contact details, identifiers, financial data, or location data.

Special-category and criminal-offence data flaggedRecommended

Activities involving health, biometric, racial or ethnic, political, religious, trade-union, sex-life or sexual-orientation data, or criminal-offence data, are clearly flagged, since these carry extra conditions and risk.

Categories of recipients

Each activity records the categories of recipients the data is disclosed to, including other processors, group companies, and recipients located in third countries or international organisations.

Transfers outside the EU/EEA identified

Where personal data leaves the EU/EEA, the record identifies the third country or international organisation receiving it. Includes remote access and sub-processor hosting outside the EU/EEA, not just deliberate exports.

Transfer safeguards documentedRecommended

For each transfer outside the EU/EEA, the Chapter V mechanism relied on (adequacy decision, standard contractual clauses, the EU-US Data Privacy Framework, or another safeguard) is recorded. Article 30 strictly requires documenting the suitable safeguards only for the narrow Article 49(1) second-subparagraph derogation transfers; recording the mechanism for every transfer is good practice and pairs with a transfer impact assessment for higher-risk routes.

Retention and erasure time limits

Each category of data has an envisaged time limit for erasure or review, rather than being kept indefinitely. Where an exact period is impossible, the criteria used to set it are recorded.

General description of security measures

The register carries a general description of the technical and organisational measures protecting the data (Article 32(1)), such as access control, encryption, and backups, kept at a level that is meaningful but does not have to be exhaustive.

Kept in writing and available to the regulator

The record is held in writing, including electronic form, and can be produced for your supervisory authority on request. A register that cannot be exported on demand does not meet this duty.

Kept current as processing changesRecommended

A defined owner and cadence keep the register current, so new systems, vendors, and processing activities are added rather than the document going stale after its first version.

Article 30(5) scope decision recorded

If you employ fewer than 250 people you have considered whether the limited Article 30(5) exemption applies, and recorded why it does not where your processing is not occasional, is likely to result in a risk to individuals, or includes special-category or criminal-offence data. Most organisations still need a record.