EU GDPR Data Mapping & Records of Processing (ROPA) Management System
EU GDPR Data Mapping & Records of Processing (ROPA) Management System
An editable system that takes an organisation from data discovery to a signed-off Article 30 record of processing activities, for controllers and processors.
Couldn't load pickup availability
Written and reviewed by practising specialists. Who writes this
Built and reviewed with our methodology. Read it
By document type
| Category | Files |
|---|---|
| Manuals | 2 |
| Policies | 2 |
| Procedures & SOPs | 14 |
| Plans & Programmes | 9 |
| Forms & Records | 93 |
| Checklists & Audit Tools | 29 |
| Registers, Logs & Matrices | 77 |
| Training & Awareness | 3 |
| Guides & Work Instructions | 4 |
| Tools & Workbooks | 7 |
| Other Documents | 3 |
Key documents
| Reference | Document | Format |
|---|---|---|
| AGS-DMR-POL-001 | Data Mapping and ROPA Policy | Word |
| AGS-DMR-PRO-001 | Data Mapping and ROPA Procedure | Word |
| AGS-DMR-PRO-006 | Data Flow Mapping Procedure | Word |
| AGS-DMR-PRO-008 | Lawful Basis Assessment Procedure | Word |
| AGS-DMR-FRM-025 | Legitimate Interests Assessment (LIA) | Word |
| AGS-DMR-REG-020 | Controller ROPA (Article 30(1)) | Excel |
- Need the complete document list? Request it — same day
- Want to check the quality first? Preview free samples
Overview
A record of processing is only as good as the discovery behind it. Records written from memory in one sitting soon drift from what the organisation actually does. This system starts with structured discovery across departments and systems, builds inventories and data-flow maps, and only then completes the record.
Separate workbooks hold the controller record and the processor record, each with a completion guide and validation checklist. Every field is mapped to Article 30, and what the Article requires is separated from good practice, field by field. The small-organisation exemption is treated as something to assess, not assume, and has its own assessment. Change control, audit and reconciliation tools keep the record aligned with real processing.
The system rests on Regulation (EU) 2016/679 (GDPR), Article 30. EDPB and Article 29 Working Party guidance is cited at document and section level and marked for verification against the published versions. Standard contractual clauses under Commission Implementing Decision (EU) 2021/914 are referred to, not reproduced. AGS is independent and is not affiliated with the European Commission, the European Data Protection Board or any supervisory authority. Regulations are referenced by citation.
What this system covers
- Governance: policy, procedure, role appointment forms, controller and processor role determination, escalation and document control.
- Discovery: questionnaires for departments, HR, marketing, CCTV, websites, mobile apps, cloud, AI, paper records and shadow IT, with interview guides.
- Inventories and flows: data inventories, registers for special-category, criminal-offence and children's data, and data-flow templates.
- Records of processing: controller and processor ROPA workbooks with completion guides, validation checklists and an exemption assessment.
- Lawful basis: assessments including legitimate interests and the Article 9 and Article 10 conditions.
- Recipients, transfers and retention: recipient and transfer registers, retention and security records, and risk tools.
- Change and reconciliation: change control, matrices, reconciliation tools and audit checklists.
- Worked examples: completed fictional sets for a Dutch e-commerce controller, a SaaS processor and a professional services LLP.
Who it's for
Controllers, joint controllers and processors in the EU and EEA, including employers, e-commerce, professional services, technology and SaaS, healthcare and education. DPOs, privacy leads, compliance managers, consultants and internal audit teams use it. The implementation plans set out a 90-day path from a standing start to an approved, evidenced record.
It is designed as the companion of the EU GDPR Privacy Notice & Transparency Management System, which builds notices from the record this system produces.
Everything you get
Every toolkit gives you a full set of working documents for your standard, ready to edit and use.
Native Microsoft files. Add your logo and adapt every document to how you work.
Your full toolkit arrives as a ZIP the moment payment clears.
One purchase covers everyone in your organisation. No per-seat fees.
Built by people who run real audits, so the content matches what assessors check.
One payment, perpetual licence for your organisation. No subscriptions, no renewals.
Full refund if your files are faulty, incomplete or not as described and we can't put it right
Frequently asked questions
What exactly do I receive?
A downloadable ZIP containing the full set of ready-to-use documents for this toolkit — manuals, procedures, forms, records, checklists, guidance and training material, all in editable Word and Excel format. The exact document count is shown at the top of this page.
Are the documents really editable?
Yes. Every file is native Microsoft Word or Excel — no locked PDFs. Add your logo, change wording, and tailor the content to your organisation. The toolkit is yours to keep and reuse.
Does this certify my organisation?
No. These are documentation toolkits aligned to the relevant standard to help you prepare. Certification itself is issued by an accredited certification body after their audit. Our toolkits give you a strong, audit-ready starting point.
How is it delivered?
Instantly and digitally. There's no physical shipment — you download the files right after payment and receive a backup link by email.
Do I get updates?
Yes. If we revise this toolkit, you're entitled to the updated version at no extra cost — just contact us with your order details.
What is your refund policy?
These are digital products, so once a toolkit has been downloaded we cannot take it back. If you have not downloaded yet, contact us and we will cancel the order and refund you in full. We also refund in full if the files are damaged, incomplete, or not what the product page described.
Cannot find your standard?
Tell us which scheme you work to. We will point you to the right toolkit.
More in EU Compliance
See all 15
DORA ICT Third-Party Risk & Digital Operational Resilience Management System
EU Compliance265 documents $2,450USD
NIS 2 Management Body & Cybersecurity Awareness Training Package
EU Compliance360 documents $550USD
NIS 2 & ISO/IEC 27001:2022 Integrated Management System
EU Compliance368 documents $950USD