Article 30 of the GDPR requires organisations to maintain detailed records of their data processing activities. Learn what must be documented and how to build a compliant register.
What is Article 30?
Article 30 of the General Data Protection Regulation (GDPR) requires both controllers and processors to maintain a Record of Processing Activities (RoPA). This is one of the most fundamental accountability obligations under the GDPR.
Who Must Comply?
All organisations that process personal data are subject to Article 30, with a limited exception for organisations with fewer than 250 employees — unless the processing is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data.
What Must Be Recorded?
For data controllers, the record must include:
- The name and contact details of the controller and, where applicable, the joint controller, the controller's representative, and the DPO
- The purposes of the processing
- A description of the categories of data subjects and categories of personal data
- The categories of recipients to whom the personal data have been or will be disclosed
- Transfers to third countries or international organisations
- Where possible, the envisaged time limits for erasure of the different categories of data
- Where possible, a general description of the technical and organisational security measures
Practical Steps
Building a compliant RoPA requires a systematic data mapping exercise. Start by identifying all business processes that involve personal data, then document the data flows for each process. Regular reviews — at least annually — are essential to keep the record accurate.
A clear, maintained RoPA helps your organisation meet this critical accountability obligation.