A record of processing activities (ROPA) is the written record that Article 30 of the UK GDPR requires controllers and processors to keep. A data inventory is the working detail behind it: the systems, flows, suppliers and retention settings that show the record is true. This guide covers both. It explains what the law requires in the UK, then how to build an inventory that stays accurate after the first project ends.
The record is also a tool for accountability. Article 5(2) of the UK GDPR says the controller "shall be responsible for, and be able to demonstrate compliance with" the data protection principles. The ICO describes Article 30 documentation as one of the measures that helps an organisation do that, in its documentation guidance.
What does Article 30 of the UK GDPR require?
Article 30 sets different contents for controllers and processors. Keep the qualifiers ("where applicable", "where possible") exactly as the law states them. They show which fields depend on your circumstances. "Where possible" is not a licence to skip a field you could fill.
| Field | Controller record, Article 30(1) | Processor record, Article 30(2) |
|---|---|---|
| Identity | Name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer | Name and contact details of the processor and of each controller it acts for and, where applicable, the controller's or processor's representative and the data protection officer |
| Purpose or activity | The purposes of the processing | The categories of processing carried out on behalf of each controller |
| People and data | A description of the categories of data subjects and of the categories of personal data | Not required |
| Recipients | Categories of recipients, including recipients in third countries or international organisations | Not required |
| International transfers | Where applicable, transfers to a third country or international organisation, naming it, and documentation of suitable safeguards for transfers referred to in the second subparagraph of Article 49(1) | The same as for controllers |
| Retention | Where possible, the envisaged time limits for erasure of the different categories of data | Not required |
| Security | Where possible, a general description of the technical and organisational security measures referred to in Article 32(1) or, as appropriate, the security measures referred to in section 28(3) of the Data Protection Act 2018 | The same as for controllers |
Three further rules apply to both records. Article 30(3) says the records "shall be in writing, including in electronic form". Article 30(4) says the controller or processor must make the record available to the regulator on request. The ICO adds that you do not need to send the record to it proactively, but you may have to produce it, for example during an investigation.
Does the 250-employee exemption apply to your organisation?
Article 30(5) says the duties in paragraphs 1 and 2 do not apply to an organisation employing fewer than 250 persons "unless" one of three conditions is met:
- the processing is likely to result in a risk to the rights and freedoms of data subjects;
- the processing is not occasional; or
- the processing includes special categories of data under Article 9(1) or personal data relating to criminal convictions and offences under Article 10.
The exemption is narrow in practice. The ICO's guidance on who needs to document their processing reads it as requiring a smaller organisation to document any processing that is not occasional, is likely to result in a risk, or involves special category or criminal offence data. Its worked example is an insurer with 100 staff. Claims, sales and HR processing must be documented because they are regular. An occasional staff survey need not be. Occasional profiling for risk classification and occasional equal opportunities monitoring must be documented because of the risk and the special category data.
The ICO also says it is good practice to document processing even where the exemption applies. If your organisation is close to the threshold, build the record anyway. It costs less than reconstructing one during a complaint or an investigation.
What has changed under the Data (Use and Access) Act 2025?
The required contents of Article 30 have not changed. On 4 October 2026, legislation.gov.uk showed "no known outstanding effects" for Article 30. One word has changed. From 30 September 2026, Article 30(4) requires records to be made available to "the Commission". This came from the Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), which took effect alongside the change in the regulator's structure on that date. Article 4 of the UK GDPR now defines "the Commission" as the Information Commission.
The ICO confirmed that the Information Commissioner's Office would transition to the Information Commission on 30 September 2026 and will continue to be known as the ICO. Its page on what the Act means for organisations was updated on 19 June 2026 to say that all data protection provisions of the Act are now in force.
The ICO's documentation guidance currently carries a notice that it is under review because of the Act and may change. Use it, but check the ICO's current version before you rely on a specific point.
What else should sit alongside the record?
The ICO recommends linking several other records to the ROPA, even where the law does not require them to sit in the same document. Its guidance on what else to document lists:
| Linked item | Why it belongs next to the record |
|---|---|
| Lawful basis and any legitimate interests | Needed for the privacy notice; link the legitimate interests assessment |
| Consent evidence | Shows how and when consent was obtained, without copying each consent into the record |
| Controller and processor contracts | A written contract must be in place when a controller uses a processor |
| Location of personal data | Helps you find information when someone makes an access request |
| Data protection impact assessments | Flags when a DPIA is needed, tracks progress and links the report |
| Personal data breaches | Marking breaches against activities shows patterns and concerns |
One addition is mandatory for some organisations. Where you process special category or criminal offence data under a condition in Schedule 1 to the Data Protection Act 2018 that requires an appropriate policy document, paragraph 41 says your Article 30 record must include which condition you rely on, how the processing satisfies Article 6, and whether the data is retained and erased in line with your policy, with reasons if it is not.
How should discovery begin when no reliable record exists?
The ICO suggests starting with an information audit or data-mapping exercise, with people from across the organisation involved and senior management support. Its guidance on how to document processing then sets out three steps: send a plain-English questionnaire to the teams that process personal data, meet key business functions directly, and review policies, procedures, contracts and data sharing agreements.
Make the questionnaire short and concrete:
- Why do you use personal data?
- Whose information do you hold?
- What information do you hold about them?
- Who do you share it with?
- How long do you keep it?
- How do you keep it safe?
Then test the answers against evidence. A useful chain looks like this:
Business interview → system list → integration map → supplier register → access records → sample trace → owner sign-off
Gaps between what people say and what systems show are findings. An unlisted spreadsheet, shared inbox, export job or analytics tag often matters more than a well-run core database. Use synthetic test records to trace flows where you can, so validation does not expose real personal data. If you already keep a data map for disputes, such as the systems and custodians map in a litigation readiness plan, reuse it as a starting point and reconcile the two.
How do you make the record granular enough?
The ICO is clear that a generic list will not meet the requirements. A list of data categories next to an unrelated list of people categories has "no meaningful links between them". The record must show which people, data, recipients and retention periods belong to which purpose.
The ICO recommends working broad to narrow. Controllers start with a business function such as HR or sales, then list each purpose, then the categories of people for that purpose, then their data categories. Processors start with each controller they act for. A practical activity row looks like this:
| Function | Purpose | People | Data categories | Recipients | Retention | Systems |
|---|---|---|---|---|---|---|
| HR | Staff administration | Employees | Contact, bank, sickness records | Payroll provider, pension scheme | Linked schedule entry | HR platform, payroll |
| HR | Staff administration | Emergency contacts | Contact details | None external | Linked schedule entry | HR platform |
| Sales | Customer orders | Customers | Contact, payment, IP address | Payment processor, courier | Linked schedule entry | Ecommerce, CRM |
The ICO publishes two spreadsheet templates, one for controllers and one for processors. It says they are not mandatory. Specialist software or an existing governance framework can work instead, if it delivers every Article 30 item.
Behind each row, keep the inventory detail: field lists, integrations, hosting location, access groups and the retention job that actually runs. Keep the ROPA at category level. Do not copy personal data into it, and control access, because the register can reveal suppliers, architecture and control gaps.
Who should own and approve each record?
No single team can attest to the whole record. Split responsibility by field:
- the business owner approves purpose, people and process boundaries;
- the system owner confirms stores, integrations, access and lifecycle behaviour;
- the data protection lead or DPO checks consistency and open gaps;
- legal reviews lawful basis, transfer analysis and linked conclusions; and
- an assurance reviewer tests selected rows independently.
The ICO points to IT for security measures, information governance for retention periods, and legal and compliance for data sharing arrangements. Record who approved each version and what evidence they saw. If supplier onboarding runs through a contract approval matrix, add a step that updates the recipients and processor fields before signature.
What events should reopen a record?
The ICO says keeping the record "is not a one-off exercise" and that it should be treated as a living document, reviewed regularly. Tie reviews to change management so updates happen when things change, not once a year.
Reopen the affected activity when:
- a new product, feature or data field launches;
- a purpose changes or a new group of people is involved;
- a supplier, processor or hosting location changes;
- a new international transfer starts;
- retention logic or access rights change;
- a breach or access request reveals an unknown flow; or
- the law or ICO guidance changes.
Some of these changes will also need a DPIA. Article 35(1) requires the controller to assess the impact of processing "prior to the processing" where it "is likely to result in a high risk to the rights and freedoms of natural persons". Use the ROPA to flag that question at intake, and link the finished assessment to the activity row.
How can you measure record quality honestly?
Separate coverage from confidence. A row that exists is one measure. A row verified against technical evidence in the last review cycle is another. Report missing owners, overdue reviews, unresolved flows, untested deletion and supplier mismatches. Avoid a single compliance percentage that hides uncertainty.
Run assurance samples on higher-risk activities. Rebuild one flow from current evidence and check that the privacy notice, recipients, access and retention match the record. Keep the test steps so another reviewer can follow the result.
UK ROPA checklist
- You have decided whether you act as controller, processor or both for each activity.
- Every Article 30(1) or 30(2) field is filled or marked "not applicable" with a reason.
- Any reliance on the 250-employee exemption is documented against Article 30(5).
- Rows link purposes to people, data, recipients and retention, not separate lists.
- International transfers name the destination and link the safeguards.
- Schedule 1 paragraph 41 details are recorded where an appropriate policy document applies.
- Lawful basis, contracts, DPIAs and breaches are linked to the relevant rows.
- Each row has a business owner, a system owner and a last-verified date.
- Change management triggers a record review.
- You can produce the record quickly if the ICO asks for it.
A maintained record lets you answer access requests, breach questions and regulator enquiries from evidence rather than memory. Gotham lets UK legal teams research UK case law and legislation, review contracts at scale and draft in Word, in one workspace. Every answer cites the passage it relies on. Read about security or get in touch.
Questions about ROPA and data inventories in the UK
Is a record of processing activities mandatory in the UK?
Yes, for most organisations. Article 30 of the UK GDPR requires each controller to keep a record of processing activities under its responsibility, and each processor to keep a record of the categories of processing it carries out for each controller. The record must be in writing, which can be electronic, and must be made available to the regulator on request.
Do organisations with fewer than 250 employees need a ROPA?
Often, yes. Article 30(5) lifts the duty for an organisation employing fewer than 250 persons only where none of its exceptions apply. The duty still applies if the processing is likely to result in a risk to individuals' rights and freedoms, is not occasional, or includes special category data or criminal offence data. The ICO's reading is that a smaller organisation must still document processing it does regularly, such as HR or customer records.
Did the Data (Use and Access) Act 2025 change the ROPA rules?
The list of required contents in Article 30 is unchanged. From 30 September 2026, Article 30(4) says records must be made available to the Commission, meaning the Information Commission, which still calls itself the ICO. The ICO says its documentation guidance is under review because of the Act, so check its current guidance before relying on older pages.
Does the ICO provide a ROPA template?
Yes. The ICO publishes two spreadsheet templates, one for controllers and one for processors. Each has sections for the information Article 30 requires and extra sections for useful information. The ICO says using them is not mandatory, and specialist software or an existing governance framework can also work if it covers every Article 30 item.
