⬇ Download the RoPA template (.md)
Plain Markdown — paste into Notion, Google Docs, Word or your wiki.
Prefer to fill it in online? Try the free RoPA generator.
What's inside
The template gives you one repeatable block per processing activity with every field Article 30 expects:
- Purpose and lawful basis (all six Art. 6 bases, plus a slot for your legitimate interests assessment)
- Data subjects and data categories, including an Art. 9 special-categories check
- Recipients and processors — so you know who needs an Art. 28 data processing agreement
- Third-country transfers with the safeguard used (adequacy decision or SCCs)
- Concrete retention periods and Art. 32 security measures
- A short filing checklist to run before each entry goes into your register
How to use it
- List every distinct thing you do with personal data (newsletter, payroll, client analytics…).
- Copy the template block once per activity.
- Fill in each field — if a field is hard to fill, that is the finding: you probably lack a DPA, a retention rule or a documented basis.
- Keep all entries in one document and review it yearly.
Go further
- Free RoPA generator — answer questions per activity, get a finished entry
- Free privacy notice generator — keep your Art. 13/14 notices consistent with your register
- What web agencies must know about DPAs
- Run a free compliance & accessibility scan on your site