# Record of Processing Activities (RoPA)
## GDPR Article 30 register — template for small organisations

Organisation: ____________________________
Role:  [ ] Controller   [ ] Processor   [ ] Both
Data protection contact / DPO: ____________________________
EU/EEA representative (Art. 27), if any: ____________________________
Date created / updated: ____________________________

> Copy this page once per processing activity and keep all entries in one
> document or spreadsheet. This template is a starting point and does not
> constitute legal advice.

---

## Activity __ of __ : [Activity name — e.g. "Client newsletter"]

| Field | Entry |
|---|---|
| **Name of the activity** | |
| **Purpose(s) of the processing** | |
| **Lawful basis (Art. 6)** | Consent (6(1)(a)) / Contract (6(1)(b)) / Legal obligation (6(1)(c)) / Vital interests (6(1)(d)) / Public task (6(1)(e)) / Legitimate interests (6(1)(f)) — circle one and explain below |
| **Legitimate interests assessment** (if basis is 6(1)(f)) | Balancing test reference / summary |
| **Categories of data subjects** | e.g. customers, employees, website visitors |
| **Categories of personal data** | e.g. name, email, IP address, billing address |
| **Special categories of data? (Art. 9)** | No / Yes — which and why |
| **Categories of recipients** | e.g. hosting provider, email service, accountant |
| **Transfers outside EU/EEA?** | No / Yes — country, recipient, safeguard (adequacy decision, SCCs Art. 46) |
| **Retention period / criteria** | e.g. 24 months after last interaction; deleted automatically |
| **Security measures (Art. 32)** | e.g. TLS, access control, 2FA, encrypted backups |
| **Source of the data** | Directly from the data subject / third party — which |

### Checklist before you file this entry
- [ ] Every purpose listed has a lawful basis
- [ ] Retention periods are concrete, not "as long as needed"
- [ ] Each recipient that processes data on your behalf has a Data Processing Agreement (Art. 28)
- [ ] Transfers outside the EU/EEA have a documented safeguard
- [ ] Your privacy notice matches what you wrote here

---

*Free template from https://hermes-passiv.pages.dev/ropa-template —
pair it with the free RoPA generator at /ropa-generator to fill in your first
entries in minutes.*