Record of processing activities (Article 30): does a small business need one?
Most small businesses should keep a record of processing activities. The Article 30(5) exemption for organisations under 250 people only applies if processing is occasional, unlikely to risk people's rights and free of special categories of data, which regular customer or employee processing rarely meets. The record lists purposes, data, recipients, transfers, retention and security measures.
The record of processing activities, often called the ROPA or the processing register, is the internal document that answers one question: what do we do with personal data, and why? It is required by Article 30 of the GDPR, and it is the backbone of the other documents, because your privacy policy, your vendor list and your replies to privacy requests all draw from the same facts.
#What is a record of processing activities?
It is a written inventory, kept up to date, of the activities in your organisation that involve personal data: managing customers, sending a newsletter, running payroll, handling support tickets, recruiting. Each activity is one entry with the same set of fields. It is not a public document; you show it to the data protection authority if they ask (Article 30(4)).
#What must it contain?
For a controller, which is a company that decides why and how personal data is used, Article 30(1) lists:
| Field | Example |
|---|---|
| Name and contact details of the controller (and DPO, if any) | Northwind Studio, privacy@northwind.example |
| Purposes of the processing | Managing customer accounts and orders |
| Categories of data subjects and of personal data | Customers: name, email, delivery address, order history |
| Categories of recipients | Payment provider, delivery partner, email platform |
| Transfers to countries outside the EEA, and the safeguards | Email platform in the US, covered by the Data Privacy Framework |
| Time limits for erasure, where possible | Accounts deleted 3 years after the last order; invoices kept 10 years |
| General description of security measures | Access control, encryption in transit, backups |
A processor, which is a company that processes data on behalf of its clients, keeps a shorter record under Article 30(2): its name and contact details and those of each controller, the categories of processing it carries out for each, any transfers outside the EEA and the security measures. Many small software and agency businesses are both: controller for their own customers and processor for their clients' data.
#Do small businesses need one?
Article 30(5) says the duty does not apply to an organisation with fewer than 250 employees, unless:
- the processing is likely to result in a risk to the rights and freedoms of people,
- the processing is not occasional, or
- it includes special categories of data (health, beliefs and so on) or criminal convictions.
The second condition is the one that matters. Customer accounts, payroll and a mailing list are not occasional, they are routine, so most businesses that process personal data in the normal course of operating end up inside the rule. The honest reading is that the exemption is narrow, and most regulators say so. Even where it might apply, a short register is the fastest way to answer a customer's security questionnaire or a privacy request.
#How to build a record that is actually useful
- Start from the business, not from the law. List the activities: sales, marketing, support, HR, finance, product analytics, security.
- Write one entry per purpose. If the same data is used for two reasons, such as delivering an order and sending offers, they are two entries because their legal basis and retention differ.
- Attach the vendors. For each activity, note which tools handle the data. This is the link to your data processing agreements and to transfers.
- Add the legal basis and the retention rule. Article 30 does not list the legal basis, but you need it for your privacy policy, so recording it once saves work.
- Note the security measures in a sentence. Not a security manual, a description a reader can understand.
- Date it and review it. A register that is not touched when you add a tool is out of date.
#Keeping it in step with your other documents
The same facts appear in three places: the register, your privacy policy, and your vendor list. When they are written separately they drift: the policy lists a tool that the register forgot, or the register mentions a retention period the policy does not. The practical answer is to keep one list of activities and vendors and generate the documents from it.
#What authorities look at
When a regulator opens an inquiry, the record is often the first document they ask for, because it shows whether you know what data you hold. A complete register does not prove you comply with everything, but a missing one is an easy finding. Under Article 83(4), infringements of Article 30 can be fined up to €10 million or 2% of worldwide annual turnover, although penalties for small businesses are usually proportionate and start with warnings and orders.
#FAQ
#Is a record of processing activities mandatory?
For most organisations that process personal data regularly, yes. Article 30(5) exempts only organisations under 250 employees whose processing is occasional, unlikely to risk people's rights and free of special categories of data.
#Does a one-person business need a record?
If you process personal data regularly, for example customer details, you should assume yes. A short register of a handful of activities takes an hour to write and is easy to maintain.
#What is the difference between a ROPA and a privacy policy?
The privacy policy is public and speaks to individuals. The record is internal and speaks to you and the authority. They should describe the same processing.
#Do I need the legal basis in the record?
Article 30 does not list it, but authorities and customers expect it, and you need it for your policy, so record it.
#Do I need a different record as a processor?
Yes. A processor keeps a record of the processing it carries out on behalf of each controller, with the fields in Article 30(2).
#In what format should I keep it?
Any written form, including electronic. A structured table that can be exported to a spreadsheet is the most practical.
#Sources
Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.