Keeping the record of processing activities (ROPA)

A business that processes personal customer data, for example in contract handling, support or marketing, must document without gaps which data is processed and for what purpose. This is exactly what the GDPR requires a dedicated record for, and many businesses underestimate it in day-to-day operations.

In short: the record of processing activities (in German: Verzeichnis von Verarbeitungstätigkeiten, VVT; in English often ROPA) is documentation required by Art. 30 GDPR and kept up to date on an ongoing basis, covering all processing operations involving personal data. Practically every business with customer data is affected, because the exception for businesses with fewer than 250 employees does not in practice apply where processing is regular. If the record is missing, substantial fines are possible.

Who is affected by the ROPA duty?

In principle, every business that processes personal data is affected, regardless of its size. Art. 30 GDPR does provide an exception for businesses with fewer than 250 employees, but it applies only if the processing is not regular, poses no risk to the rights of the data subjects and does not involve special categories of data. As soon as a business processes customer data in contracts, newsletters, accounting or support, that is regular processing, so the exception in practice almost never applies. In practice, nearly all businesses with customer contact must therefore keep a ROPA, from the sole trader with an online shop to the agency with several employees. The size of the business therefore decides the duty less often than the nature of the processing.

What do you need to do in practice?

For each processing operation, such as contract handling, marketing, support or accounting, you must document the purpose for which it takes place, the legal basis it rests on, which groups of people and categories of data are affected, who receives the data and how long it is stored. In addition, references to the technical and organisational measures (TOMs) for each processing activity should be included, as they are closely linked to the ROPA. The following overview shows what information should be recorded as a minimum for each processing operation:

A tool such as Company Audit gives an overview of which of these obligations apply to your business specifically.

How do you go about building the record?

Building it follows a clear sequence that can be implemented with a simple table:

1. List all processing operations involving customer data (contract handling, marketing, support, accounting …).
2. For each operation, document the purpose, legal basis, affected groups of people and categories of data.
3. Record the recipients, including external service providers, and the deletion periods for each operation.
4. Add TOM references for each processing activity.
5. Keep the record up to date whenever new processes or tools are introduced.

What practical tips help with implementation?

In practice, a simple but fully maintained table is enough for implementation: an elaborate software tool is not legally required. What matters is that all processing operations are captured and that the table is updated promptly when things change. It also makes sense to put the ROPA at the start of data protection compliance: because it makes all processing operations visible, it forms the foundation on which further obligations, such as data processing agreements, technical and organisational measures or the handling of data breaches, can sensibly be built. Anyone who creates the record first will automatically see where processing agreements (DPAs) are still missing or TOMs need tightening.

By when and how often does the record have to be maintained?

The ROPA is not a one-off task; it must be kept up to date on an ongoing basis. As soon as a new process, tool or service provider that processes personal data is added, the record must be extended accordingly. Art. 30 GDPR does not specify a fixed deadline for the initial creation, but the obligation exists from the point at which personal data is processed regularly, which is generally from the start of business.

What happens in the event of a breach?

If a record is missing or incomplete, this is an infringement of Art. 30 GDPR. The GDPR provides for fines of up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher. In addition, a missing ROPA can make clarification harder during an inspection by the authorities or after a data breach and reinforce the impression of a lack of compliance.

Frequently asked questions

Do I really have to keep a ROPA as a small business?

In most cases, yes. The exception for businesses with fewer than 250 employees applies only to infrequent, low-risk processing without special categories of data. As soon as customer data is processed regularly, the exception falls away, and that affects small businesses and the self-employed too.

Is a simple Excel spreadsheet enough as a record?

Yes. A simple table is legally sufficient as long as it is complete and contains all the information required by Art. 30 GDPR. Special software is not required.

Does the record have to be publicly accessible?

No, the ROPA is internal documentation. However, it must be possible to produce it at any time at the request of the supervisory authority.

How does the ROPA relate to other data protection obligations?

The ROPA forms the basis for many further obligations, such as data processing agreements (DPAs), technical and organisational measures (TOMs) or the reporting of data breaches. It is therefore advisable to create the record first.

Who in the company is responsible for the ROPA?

Company management is responsible as the controller under data protection law. If a data protection officer has been appointed, they support the setting up and maintenance of the record.

Source: Art. 30 GDPR. This article is general information and does not replace legal advice in an individual case. As of: July 2026.