A GDPR record of processing activities (ROPA) is the written record Article 30 requires each controller and processor to keep and show a supervisory authority on request. Organisations under 250 employees are exempt only if none of three triggers applies, and regular staff processing alone is enough to trigger it.
This guide is for privacy leads, DPOs and compliance managers, including those in GCC companies that fall within GDPR scope or keep Saudi or UAE PDPL records.
What must a GDPR record of processing activities contain?
Article 30(1) of Regulation (EU) 2016/679 lists seven points, (a) to (g), for a controller. The table splits point (c) in two, shows which are absolute and sets them against the Saudi and UAE lists.
| Field | GDPR Article 30(1) | Saudi PDPL (Implementing Regulation Article 33) | UAE PDPL (Article 7(4)) |
|---|---|---|---|
| Name and contact details of the controller, and of any joint controller, representative and DPO | Always (others where applicable) | Yes, DPO where required | Yes, controller and DPO |
| Purposes of the processing | Always | Yes | Yes |
| Categories of data subjects | Always | Yes | Not in the list |
| Categories of personal data | Always | Yes | Yes |
| Categories of recipients | Always, including those in third countries | Yes | Not in the list |
| Transfers out of the country | Where applicable, naming the third country | Yes, a description with the legal basis and recipients | Cross-border movement data |
| Time limits for erasure | Where possible | Where possible, per category | Erasure mechanism and processing times |
| General description of security measures | Where possible | Where possible | Yes |
| Persons authorised to access the data | Not required | Not in the list | Yes |
| Lawful basis, systems, data flows, data source | Not required | Not in the list | Not in the list |
Many data-mapping pages imply that Article 30 requires a data map or your lawful basis. It does not. Those columns are useful extras, not legal fields.
A processor keeps a shorter record under Article 30(2). It names the processor, each controller it acts for, any representatives and the DPO. It lists the categories of processing for each controller, transfers and, where possible, security measures. If you run an information security management system, our guide to ISO/IEC 27001:2022 explains where the security description comes from.
Are you exempt with fewer than 250 employees?
For most organisations, no. Article 30(5) lifts the duty below 250 employees only if no trigger applies. The triggers are processing likely to result in a risk to people's rights, processing that is not occasional, and special-category (Article 9(1)) or criminal-offence (Article 10) data.
The Article 29 Working Party's position paper of 19 April 2018, now listed on the EDPB website, says any one trigger is enough, and "risk" means any risk, not only high risk. Some vendor guides say small firms need a record only for sensitive or criminal data. That drops two of the three triggers.
Staff data is the usual trigger. The paper's own example is a small organisation that regularly processes employee data. That processing is not occasional, so it must be recorded. Only the triggering processing needs recording, not everything.
The French authority, the CNIL, names payroll, customer, prospect and supplier management, geolocation and video surveillance as processing small companies must still record. Its example of what stays out is an advertising campaign for a new branch opening, if it poses no risk. When in doubt, it says, include it.
Is the threshold rising to 1,000 employees?
It is proposed, not in force. The Commission's proposal, COM(2025) 501 of 21 May 2025, set the line at 750 employees unless processing is likely to result in a high risk.
The provisional agreement between Parliament and Council negotiators, dated 26 June 2026 and approved in a Parliament committee on 2 July 2026, says fewer than 1,000 employees. A smaller organisation would still record any specific activity likely to result in a high risk under Article 35, and any core activity that requires a DPO under Article 37(1)(b) or (c). The record would cover only that activity. The recitals say public authorities should not benefit, and that special-category data processed for employment and social security duties would not as such need a record unless assessed as high risk.
On 4 October 2026 the Legislative Observatory file showed it awaiting Parliament's first-reading position, with an indicative plenary date of 23 November 2026. Council adoption and publication in the Official Journal would follow, with entry into force 20 days later. Until then, the 250 rule and its three triggers are the law.
How do you build the record from a data map?
The GDPR never uses the words "data mapping" or "inventory". Article 30 requires a record. Mapping is the method you use to build it.
The UK regulator, the ICO, sets out a practical method for the UK GDPR. Its guidance is under review after the Data (Use and Access) Act, so treat it as method only:
- Send a plain-language questionnaire to each area that handles personal data: why you use it, whom it is about, what you hold, who receives it, how long you keep it and how you protect it.
- Meet IT on security, information governance on retention and legal on data-sharing arrangements.
- Review policies, processor contracts and data-sharing agreements, and compare intended processing with actual processing.
Then work broad to narrow. Controllers usually start with a business function, processors with each controller. The ICO warns that a generic list with no links between purposes, people and data will not meet the requirement. The CNIL asks for one entry per processing activity, and one per type of service in a processor record, such as hosting or IT maintenance.
What changes for a company outside the EU?
If Article 3(2) brings your non-EU company into scope, you keep the same record. It must name your EU representative under Article 30(1)(a). The representative also maintains the record and must produce it on request (Article 30(4)). The EDPB says your company stays responsible for the content and must keep the representative's copy current.
Processors outside the EU can be caught directly. On 11 December 2025 the CNIL fined the processor MOBIUS SOLUTIONS LTD EUR 1 million. It ran personalised advertising campaigns for Deezer. It kept data of more than 46 million Deezer users after the contract ended, used it without instructions, and kept no processor record under Article 30.
The company is not established in the EU. The CNIL treated its analysis, segmentation and hosting of user data as monitoring of behaviour, which brought it within the GDPR. With no EU establishment, the one-stop shop did not apply.
Gaps count too. In a final decision of 18 December 2024, the Polish authority fined Toyota Bank Polska EUR 72,000 under Articles 30(1) and 35. Credit-risk profiling was missing from its record and had no DPIA. Article 30 sits in the fine tier of up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher.
How do the Saudi and UAE PDPL record duties compare?
Both require a processing record that the regulator can see on request. None of Saudi PDPL Article 31, Implementing Regulation Article 33 or UAE PDPL Articles 7(4) and 8(7) contains a headcount exemption. UAE Article 3 does let the Data Office exempt establishments that do not process a large volume of personal data, under standards set by the Executive Regulations.
The Saudi texts place the duty on the controller and set no separate processor record. The record is kept for the whole period of processing and for five years after an activity ends. Our guide to Saudi PDPL enforcement covers the regulator's approach.
UAE Federal Decree-Law 45 of 2021 requires a controller record (Article 7(4)) and a processor record (Article 8(7)), both submitted to the Data Office on request. The fields overlap with the GDPR but are not the same, so check each list rather than assume one record satisfies all three laws. A privacy information management system under ISO/IEC 27701 also keeps processing records.
How AGS can help
The EU GDPR Data Mapping & Records of Processing (ROPA) Management System has 243 editable Microsoft Word and Excel documents. It includes a Controller ROPA workbook for Article 30(1) and a Processor ROPA workbook for Article 30(2), each with representative columns. It also has an Article 30 Exemption Assessment, 11 discovery questionnaires, eight data-flow templates and an Article 30 Field Compliance Matrix. It does not appoint an EU representative.
Frequently asked questions
How often must we update the record?
Article 30 sets no review cycle. Article 24(1) requires a controller's compliance measures to be reviewed and updated where necessary, so update the record when a system, supplier or purpose changes, and keep a review log with owner sign-off.
What if we are both a controller and a processor?
The CNIL says the record must separate the two roles clearly, and recommends two records.
Do supervisory authorities publish ROPA templates?
Yes. The CNIL publishes a basic model record as an ODS spreadsheet on its record of processing activities page, and the ICO offers controller and processor templates in Excel. Neither is mandatory, because Article 30(3) requires only written form, including electronic.
Can our DPO own the record?
Yes. The CNIL says a DPO, if appointed, can be put in charge of the record.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by the European Commission, the EDPB, the CNIL, the ICO, SDAIA or any other authority. It is general information, not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
