Record of Processing Activities (ROPA) Checklist Template

What the ROPA Checklist Covers

1. 1
   Phase 1

   Phase 1: Scope, Roles & Exemption

   6 tasks

   The record owner starts the run on the day the review begins. Task 1 sets the type of run, the law that applies, the organisation’s roles and the people involved. Every due date counts in working days from the review start date.

   • Record the organisation, the type of run and who is involved — the organisation, the review start date, whether this is a first record, an annual review or a review after a change, which GDPR applies, whether the organisation also acts as a processor, how many people it employs, and the record owner, the approver, the security lead and the records manager
   • Set the scope of the record — the legal entities, business functions, sites and systems the record covers; Article 30(1) puts the duty on each controller, so name every legal entity that decides why and how personal data is used
   • Fewer than 250 employees: decide which activities must still be recorded — Article 30(5) says the duty does not apply to an organisation employing fewer than 250 persons unless the processing is likely to result in a risk to people’s rights and freedoms, is not occasional, or includes special category or criminal offence data; the ICO reads this as recording every activity that meets any one of the three
   • First record: choose the format and structure of the record — a spreadsheet, the ICO’s templates for controllers and processors, or a privacy tool, kept in writing (electronic form counts) and built broad to narrow: business function, then purpose, people, data, recipients and retention, with meaningful links between them
   • Review: gather the current record and the last review’s open actions — the approved record with its version and date, the changes teams have reported since, and any actions left open at the last review
   • List the business functions and who will answer for each — every team that uses personal data, such as HR, sales, marketing, customer service, finance, IT and legal, with one person who answers the questionnaire and comes to the interview
2. 2
   Phase 2

   Phase 2: Interviews & Questionnaires

   8 tasks

   The ICO suggests a questionnaire to every area that handles personal data, meetings with key business functions and a review of policies, contracts and agreements. Record what each team says before writing anything into the record.

   • Send the questionnaire to each business function — the plain questions the ICO suggests: why do you use personal data, who do you hold information about, what do you hold about them, who do you share it with, how long do you keep it and how do you keep it safe; this template adds which systems hold it and whether any of it leaves the UK or EEA
   • Interview HR about staff, applicant and former staff data — recruitment, employment records, payroll, absence and health, pensions, training, monitoring and leavers, including health data and any equal opportunities data on ethnic origin, religion, sexual orientation or disability, which is special category data
   • Interview the customer-facing teams — sales, marketing and customer service: customer and prospect records, marketing lists and consents, call recordings, website and app data, and any profiling or segmentation
   • Interview finance and procurement — payments, invoicing, credit checks, supplier contacts, expenses, and any data passed to banks, auditors or tax authorities
   • Interview IT about systems, data locations and security — the systems and cloud services that hold each team’s data, where they are hosted and supported from, backups, access controls, encryption and logging; the security lead uses the answers to describe the measures in Phase 3
   • Interview legal and compliance about sharing, contracts and consents — data sharing agreements, processor contracts, joint controller arrangements, consent records, DPIAs and the breach log
   • Review policies, procedures, contracts and agreements — privacy notices, data protection, retention and security policies, system procedures, processor contracts and data sharing agreements, compared with what the teams said they actually do
   • Review: compare the answers with the current record — each activity in the current record marked unchanged, changed or stopped, and every new activity the teams described that the record lacks
3. 3
   Phase 3

   Phase 3: The Controller Record

   8 tasks

   Article 30(1) lists what a controller’s record must contain. The ICO asks for a granular record with meaningful links: each purpose tied to its people, data, recipients and retention period, not separate lists.

   • Record the organisation’s details, joint controllers, representative and DPO — the name and contact details of the organisation and, where they apply, of any joint controller, the representative and the data protection officer (Article 30(1)(a))
   • List each processing activity and its purpose — every purpose for which the organisation uses personal data, grouped by business function, such as staff administration, customer orders or marketing (Article 30(1)(b))
   • Describe the people and the personal data for each activity — the categories of data subjects, such as employees, customers or suppliers, and the categories of personal data held about each, linked to the purpose they serve (Article 30(1)(c))
   • Record the recipients for each activity — the categories of recipients the data has been or will be disclosed to, such as processors, other controllers and public authorities, including recipients in other countries (Article 30(1)(d))
   • Record the retention period for each category of data — where possible, the envisaged time limits for erasure of each category of data, taken from the retention schedule (Article 30(1)(f)); check any period a team gave against the schedule
   • Describe the security measures — where possible, a general description of the technical and organisational measures under Article 32(1), such as encryption, access controls, backups and staff training (Article 30(1)(g))
   • Add the lawful basis and the other privacy notice details — not required by Article 30, but the ICO suggests keeping them with the record: the lawful basis, any legitimate interests, the rights that apply, any automated decision-making including profiling, and the source of the data
   • Record where each activity’s data is held — the systems, paper files and processors that hold it, which the ICO suggests recording so the data can be found quickly, for example when someone asks for a copy of their data
4. 4
   Phase 4

   Phase 4: The Processor Record

   5 tasks

   Applies only when task 1 says the organisation also processes personal data on behalf of other organisations. Article 30(2) asks for a separate, shorter record of that processing.

   • Processor: list each controller and its contact details — the name and contact details of each controller the organisation acts for, any controller’s or processor’s representative, and the data protection officer (Article 30(2)(a))
   • Processor: record the categories of processing for each controller — what the organisation does with the data for each controller, such as hosting, payroll processing, analytics or sending email (Article 30(2)(b))
   • Processor: record transfers made for each controller — where applicable, each third country or international organisation the data goes to for that controller, and the documented safeguards for any transfer under the second subparagraph of Article 49(1) (Article 30(2)(c))
   • Processor: describe the security measures for this processing — where possible, a general description of the Article 32(1) measures that protect each controller’s data (Article 30(2)(d))
   • Processor: link each controller’s contract — the contract or other legal act with each controller that Article 28(3) requires, linked from the record so the controller’s instructions can be checked against the processing recorded
5. 5
   Phase 5

   Phase 5: Special Category Data & Transfers

   8 tasks

   Two checks across every activity. Special category or criminal offence data adds the conditions to record, and data leaving the UK or EEA adds the transfer details. Each answer shows its own tasks.

   • Check each activity for special category and criminal offence data — data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used to identify someone, health data, and data about sex life or sexual orientation (Article 9(1)), and data about criminal convictions and offences (Article 10)
   • Special category: record the conditions relied on for each activity — for each activity, the Article 9(2) condition for special category data, or how processing of criminal offence data is authorised under Article 10, alongside the Article 6 lawful basis
   • Special category (UK): add the details Schedule 1 of the DPA 2018 requires — where the organisation relies on a Schedule 1 condition that needs an appropriate policy document, the record must say which condition is relied on, how the processing satisfies Article 6, and whether the data is retained and erased in line with the policy document, with the reasons if it is not (Schedule 1 paragraph 41)
   • Special category (UK): check the appropriate policy document — it explains the procedures for complying with the Article 5 principles and the retention and erasure policies for this data (paragraph 39), is reviewed and updated from time to time, and is kept until 6 months after the processing stops (paragraph 40)
   • Find out which activities send data outside the UK or EEA — any activity whose data is sent to, or can be reached from, a country outside the UK under the UK GDPR or outside the EEA under the EU GDPR, including hosting, support access and processors abroad
   • Transfers: name each country or international organisation — for each activity, the third country or international organisation the data goes to and the recipient there, as Article 30(1)(e) asks
   • Transfers: record the transfer mechanism for each destination — adequacy, or the safeguard used, such as standard clauses or binding corporate rules, with the transfer risk assessment where one is needed; the ICO suggests documenting the transfer mechanism safeguards in the record
   • Transfers: document any exceptional transfers — a transfer under the second subparagraph of Article 49(1), which is not repetitive, concerns a limited number of people and serves compelling legitimate interests, needs its assessment and suitable safeguards documented in the record (Article 49(6)), and the regulator must be informed of it
6. 6
   Phase 6

   Phase 6: Links to Notices, DPIAs & Contracts

   5 tasks

   The ICO suggests documenting, or linking to, the records that show compliance elsewhere. With the links in place, a change to one activity is easier to trace to its notice, DPIA and contracts.

   • Compare the record with the privacy notice — every purpose, recipient, retention period and transfer in the record is described in the privacy notices given under Articles 13 and 14, and the notices describe nothing the record lacks
   • Link each high-risk activity to its DPIA — the DPIA report for each activity likely to result in a high risk to people (Article 35), or a flag that one is needed; the ICO suggests using the record to flag DPIAs and track their progress
   • Link processor contracts and data sharing agreements — each processor in the record linked to its Article 28 contract, and each disclosure to another controller linked to its data sharing agreement
   • Link the consent records where consent is the lawful basis — for each activity that relies on consent, a link to where each consent is recorded and how it was given, rather than copying consents into the record
   • Mark personal data breaches against the activities they affected — each breach in the breach log marked against the activity it affected and linked to its documentation, which the ICO suggests so patterns and areas of concern show up
7. 7
   Phase 7

   Phase 7: Gaps & Fixes

   4 tasks

   List every gap the review found. When there are gaps, the record’s own gaps are fixed before approval, and the fixes that sit elsewhere get an owner and a date.

   • Decide whether the record has gaps — activities missing from the record, fields left blank, retention periods or transfers not known, links missing, and entries that no longer match what the teams do
   • Gaps: give each gap an owner, a fix and a date — every gap in one list, with what will fix it, who owns the fix and when it is due
   • Gaps: fix the gaps in the record itself — missing activities, purposes, recipients, retention periods, transfers or security descriptions added and checked with the team concerned before the record goes for approval
   • Gaps: raise the fixes that sit outside the record — a missing DPIA, processor contract, privacy notice update, retention period or transfer safeguard, each raised with its owner and tracked after approval
8. 8
   Phase 8

   Phase 8: Approval, Publication & Next Review

   7 tasks

   The DPO or privacy lead approves the record before it is published to the people who keep it. The approval is the gate: publishing, briefing the teams and setting the next review wait until it is done.

   • Prepare the record and a summary for approval — the updated record, what changed since the last version, the gaps found and fixed, any still open, and anything the approver must decide
   • DPO or privacy lead approves the record — the record and the summary read, open gaps accepted or sent back, and the decision recorded; if the record is not ready, record what must change and leave this task open, because nothing after it can be completed until it is done
   • Publish the approved record to the people who keep it — the approved version saved in its agreed place with its version number and date, changed only by the record owner, and shared with the teams who report changes
   • Tell each team which changes they must report — a new system, supplier, purpose, kind of data, transfer or retention period reported to the record owner before it starts, so the record stays current between reviews
   • Gaps: track the remaining fixes to closure — each fix outside the record followed up by its due date, and the record updated as each one closes
   • Keep the record ready to show the regulator — Article 30(4) says the record is made available to the regulator on request, so know where it is, who can produce it and in what form
   • Set the next review date — a full review a year after this one, which is this template’s choice, and an update sooner after a change such as a new system, an acquisition or a new purpose; the ICO asks for regular reviews so the record reflects current processing