Generated record
Need a published policy too? Use the free privacy notice generator. Cover your contracts with the free Article 28 DPA generator, check your public pages with the free EAA scanner, or see all free tools — and browse the GDPR e-book and template kit. This document is a draft and does not constitute legal advice.
Why keep a record of processing activities
- It is legally required. GDPR Article 30 obliges controllers and processors to maintain written records of every processing activity. Failing to produce one during an inspection is itself a violation, with fines up to €10 million or 2% of global turnover.
- It drives everything else. Your RoPA tells you where DPAs are needed, what your privacy notices must say, how long data may be kept and where breach notifications would have to go. It is the backbone document of practical GDPR work.
- It is the first thing auditors ask for. Supervisory authorities, enterprise clients doing vendor assessments and certification bodies all start with "show us your records".
Prefer to work in your own document? Download the free RoPA template.