Records of Processing Activities (ROPA)

Records of processing activities (ROPA) are the internal documentation required by Article 30 GDPR. They list every process in which a business handles personal data, with its purpose, categories of data and people, recipients, transfers, retention periods and security measures, and must be shown to the supervisory authority on request.

What are records of processing activities?

Records of processing activities, often called ROPA or simply “Article 30 records”, are a written inventory of how your business uses personal data. Each entry describes one processing activity, such as payroll, customer service, the newsletter or WhatsApp support.

Under Article 30(1) of the GDPR and the UK GDPR, a controller’s records must contain:

  • The name and contact details of the controller (and, where applicable, the data protection officer)
  • The purposes of the processing
  • The categories of individuals and of personal data
  • The categories of recipients, including processors
  • Transfers to countries outside the EU/EEA (or, for the UK GDPR, outside the UK) and the safeguards used
  • Where possible, the envisaged time limits for erasure
  • Where possible, a general description of the technical and organisational measures

Processors keep their own, shorter records under Article 30(2), covering the processing they carry out on behalf of their clients.

Why it matters, even for small businesses

The records are not public. You do not publish them on your website. But you must make them available to the supervisory authority on request, and they are usually the first document an auditor or regulator asks for after a complaint or a data breach.

Article 30(5) contains an exemption for organisations with fewer than 250 employees. In practice it rarely applies, because it falls away as soon as the processing:

  • is likely to result in a risk to people’s rights and freedoms,
  • is not occasional, or
  • includes special category data or criminal offence data.

Customer management, payroll and day-to-day customer messaging are not occasional. So most small businesses need records at least for these regular activities. A missing record is a breach of its own, regardless of whether anything else went wrong. Beyond compliance, the records are useful: they show where data sits, which tools are involved and where a data retention policy is still missing.

Example: a trades business in Nottingham

A trades business in Nottingham with 18 employees starts using WhatsApp to arrange appointments and send quotes. Its records already cover payroll, accounting and the website contact form. Now it adds a new entry:

  • Activity: customer communication via WhatsApp and SMS
  • Purpose: arranging appointments, sending quotes, answering questions
  • Lawful basis: contract and pre-contractual steps; legitimate interests for service reminders
  • Data: name, phone number, address, photos of the job, message history
  • Recipients: the messaging platform as processor; Meta as provider of the WhatsApp channel
  • Transfers: platform hosted in the EU; WhatsApp data processed by Meta, partly in the US, under the Data Privacy Framework and standard contractual clauses
  • Retention: conversations deleted two years after the last job, unless longer retention is required
  • TOMs: reference to the provider’s security measures and the signed DPA

The entry fits on one page, and the next time a customer asks what happens to their data, the answer is already written down.

Your records and SendSeven

When you use SendSeven, we act as your processor. For your records, that means:

  • Hosting location documented: hosted in the EU (Frankfurt, Google Cloud).
  • A DPA under Article 28 (see data processing agreement).
  • Security measures disclosed: encrypted in transit and at rest, role-based access control with custom roles.
  • Channels listed separately: for WhatsApp, Instagram and Messenger, add Meta as a recipient in your records.

More on the overall picture in GDPR-compliant messaging.

This is general information, not legal advice. Check the details with your data protection lead or compliance consultant.