# Records of processing activities (ROPA)

The written inventory of your personal data processing that UK GDPR and EU GDPR Article 30 require controllers and processors to keep.

Source: https://sted.digital/docs/glossary/records-of-processing · Last reviewed 17 October 2026 · Strand Glossary

Records of processing activities (ROPA) are the written inventory of how your organisation uses personal data: one entry per activity, saying what data, about whom, for what purpose, shared with whom, sent where, kept how long and protected how. They are your main proof of accountability, and the regulator can ask to see them.

## Where the term appears

UK GDPR Article 30(1) sets what a controller's record holds and UK GDPR Article 30(2) the shorter record a processor keeps. Under UK GDPR Article 30(4) you must make the record available to the regulator on request; since 30 September 2026 the UK text names the Information Commission. EU GDPR Article 30 has the same structure. The [records of processing page](/docs/standards/gdpr/records-of-processing) lists every field.

### The small-business exemption is narrow

UK GDPR Article 30(5) exempts organisations with fewer than 250 employees, but not for processing that is likely to put people at risk, is more than occasional, or includes special category or criminal offence data. Payroll runs every month, so almost every employer keeps a record for that at least. Auditors also expect a lawful basis against each activity, although Article 30 does not list it. Proposals in the EU to widen the exemption are not law.

## How Sted uses it

Onboarding asks about the personal data you process, activity by activity (its purpose, who it is about, how long it is kept and whether you act as controller or processor), and about transfers abroad with their safeguard; Summary's Data and privacy card lists the processing activities by name and status and each transfer's recipient, role and destination.
The card is a summary of what onboarding recorded, not a record of processing activities.
Sted's Personal Data Protection Policy (POL-PDP) has its own sections on lawful basis, special category data, individuals' rights, security, processors and international transfers, records of processing and the data protection officer, each tagged to the UK GDPR and EU GDPR requirements it meets.

## Related terms

- [Personal data](/docs/glossary/personal-data): what the record maps.
- [Lawful basis](/docs/glossary/lawful-basis): recorded against each activity.
- [Controller and processor](/docs/glossary/controller-and-processor): each role keeps its own version.
- [International transfer](/docs/glossary/international-transfer): one of the fields a controller's record must cover.
- [Data protection officer (DPO)](/docs/glossary/data-protection-officer): one of the contacts the record names.