Is a RoPA the same as a data inventory?

Substantially yes - a Record of Processing Activities (Art. 30) is the GDPR's formal name for your data inventory. It lists every processing activity with its purpose, data categories, recipients, transfers, retention, and security measures. Some teams use data map for the visual flow and RoPA for the register; both describe the same accountability backbone.

Do small businesses under 250 employees need a RoPA?

Usually yes. Article 30(5) exempts under-250-employee orgs only if processing is not regular, not occasional, and involves no special-category data. Routine invoicing, payroll, marketing, and most real processing fail those carve-outs, so assume the RoPA applies.

What happens if I don't have a RoPA?

A missing or incomplete RoPA is itself a GDPR breach (accountability principle, Art. 5(2)), and supervisors can request it at any time. Fines for Art. 30 violations can reach 10M or 2% of global turnover. Beyond fines, you cannot reliably answer rights requests or manage breaches without it.

What format does the RoPA have to be in?

There is no prescribed template. It must be in writing (including electronic form) and cover the Art. 30(1) elements. A well-structured spreadsheet is fine for an SME; larger organisations often use governance tools linked to DPIAs and vendor registers.

How detailed must each entry be?

Specific enough to demonstrate accountability. Marketing alone is insufficient; describe the actual activities, data-subject groups, data categories, retention, legal basis, and processors. High-risk activities need more detail than routine, low-risk ones.

Data inventory & RoPA best practices (GDPR Art. 30)

A data inventory — formally the Record of Processing Activities (RoPA) under Article 30 GDPR — is the master list of every way your organisation processes personal data (GDPR.eu — Art. 30). It is the first document a supervisory authority asks for in an inspection, and it underpins almost everything else: your privacy notice, your lawful-basis choices, your DPIAs, and your breach response. If you don't know what you process, you can't comply with anything downstream. This guide covers how to build and maintain one without a consultant. For the wider duty set, see the GDPR compliance guide; for spotting where data actually leaks, see PII detection methods.

1. What the RoPA must contain (Art. 30(1))

For each processing activity, the record must list:

Controller details — name, contact, DPO where applicable.
Purposes — a specific purpose, not vague "marketing."
Categories of data subjects and data — customers, employees; names, emails, financial, health.
Recipients — CRM, accountant, hosting, any processor; plus transfers.
International transfers — destination and safeguard (SCCs, adequacy).
Retention — envisaged erasure timelines (never "indefinitely").
Security measures — a general description of TOMs (Art. 32).

A generic one-line "marketing" entry is insufficient; supervisors expect specifics per activity (Ireland GDPR — RoPA template). Most organisations hold between ten and several dozen entries — one per distinct activity (customer management, recruitment, newsletter, invoicing).

2. The "under 250 employees" exemption is narrower than it looks

Article 30(5) exempts organisations with fewer than 250 employees — but only if the processing is not regular, not occasional, and involves no special-category data. In practice that exemption rarely applies: invoicing repeat customers, paying staff, storing supplier contacts, marketing automation, and employee monitoring all fail the carve-outs (GDPRWise — do I need a register?). Assume a RoPA applies the moment you have your first customer, supplier, or employee.

3. How to build it (without a consultant)

List every processing activity across the business (forms, CRM, HR, analytics, support).
Interview process owners and review IT inventories and vendor contracts.
Fill one row per activity with the Art. 30(1) fields above.
Separate controller vs processor activities.
Keep it in writing — a structured spreadsheet is acceptable for SMEs; larger orgs use governance tools (Pitch Law — RoPA).
Integrate upkeep into vendor onboarding and change management so it never goes stale.

4. RoPA feeds your DPIA and your breach plan

The RoPA is the input to a privacy risk assessment / DPIA: high-risk entries (large-scale special-category data, systematic monitoring, profiling) are exactly the ones that trigger Art. 35. It is also what you consult during a breach to know who is affected and where data went. Treat it as a living register, not a one-off spreadsheet.

Decision-support note. PrivScan can surface likely data-collection points — forms, trackers, and third-party scripts — that should appear in your inventory, and return a prioritized checklist of gaps to reconcile against your RoPA. It supports the inventory; it does not create the legal record for you.

Data inventory & RoPA best practices (GDPR Art. 30)

Data inventory & RoPA best practices (GDPR Art. 30)

1. What the RoPA must contain (Art. 30(1))

2. The "under 250 employees" exemption is narrower than it looks

3. How to build it (without a consultant)

4. RoPA feeds your DPIA and your breach plan

FAQ