Every controller and processor with 250 or more employees. (UK GDPR Art 30(5)) Smaller organisations for any processing that is not occasional, such as payroll or customer records. (Art 30(5)) Smaller organisations for any processing likely to result in a risk, or involving special category or criminal offence data. (Art 30(5))

What happens if it goes wrong?

Regulatory: Missing or incomplete records breach Art 30. A breach of this duty sits in the standard tier of penalties: up to £8.7 million or 2% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice. Criminal: No offence. Civil: No freestanding claim, but gaps in the record undermine any defence to a claim under Art 82.

What is a record of processing activities, and who must keep one?

A record of processing activities (ROPA) is a written inventory of what personal data you process, why, about whom, who receives it, where it goes and how long you keep it. Every controller and processor must keep one; organisations with fewer than 250 staff are exempt only for processing that is occasional, low risk and free of special category or criminal offence data, which in practice leaves most organisations needing one.

Data protection

What it is

Article 30 UK GDPR lists what a controller's record must contain: name and contact details, purposes, categories of people and data, recipients, international transfers, retention periods and a general description of security measures. Processors keep a shorter record for each controller they act for. The DUAA 2025 kept this duty unchanged.

Who must keep one

Every controller and processor with 250 or more employees. UK GDPR Art 30(5)
Smaller organisations for any processing that is not occasional, such as payroll or customer records. Art 30(5)
Smaller organisations for any processing likely to result in a risk, or involving special category or criminal offence data. Art 30(5)

Who is responsible

The controller for its own processing, and the processor for the processing it carries out for each controller. The record must be in writing, including electronic form, and provided to the regulator on request.

What it involves

Run a data mapping exercise across teams.
Record each processing activity with the Art 30(1) fields.
Link it to lawful bases, retention schedules and, where needed, appropriate policy documents.
Keep it current, owned and reviewed.

If it goes wrong

Regulatory: Missing or incomplete records breach Art 30. A breach of this duty sits in the standard tier of penalties: up to £8.7 million or 2% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice.
Criminal: No offence.
Civil: No freestanding claim, but gaps in the record undermine any defence to a claim under Art 82.

Go further

The law: UK GDPR
Guides: Records of processing that earn their keep, Catalogues, lineage and metadata
Checklists: Records of processing (Art 30)

Sources

Primary UK GDPR, Article 30 legislation.gov.uk
Regulator Documentation Information Commissioner's Office
Secondary Data (Use and Access) Act 2025: a comparison with its predecessor, the DPDI Bill Stephenson Harwood

Updated 2026-11-09