--- title: "ROPA UK GDPR: How to Build and Maintain One | Trust Keith" description: "ROPA explained: what UK GDPR Article 30 requires, who needs one, what it must contain, and how to build and keep it current." image: https://resources.trustkeith.co/hubfs/Resources%20Card%20template%2c%20Guides%20(57).png --- [![642bcbad7735490755580d8d\_trust-keith-logo](https://resources.trustkeith.co/hubfs/642bcbad7735490755580d8d_trust-keith-logo.svg "642bcbad7735490755580d8d_trust-keith-logo")](https://www.trustkeith.co/) - Product - [Privacy OS](https://www.trustkeith.co/product/privacy-os) - [Dedicated DPO](https://www.trustkeith.co/product/dedicated-dpo) - [Automated Data Discovery](https://www.trustkeith.co/product/automated-data-discovery) - [Intelligent Workflows](https://www.trustkeith.co/product/intelligent-workflows) - [Staff Training](https://www.trustkeith.co/product/staff-training) - [Global Risks & Controls](https://www.trustkeith.co/product/global-risks-controls) - [Proportional Policies](https://www.trustkeith.co/product/proportional-policies) - [Monitoring & Reporting](https://www.trustkeith.co/product/monitoring-reporting) - Solutions - [By Industry](https://www.trustkeith.co/solutions/industry) - [By Team](https://www.trustkeith.co/solutions/team) - [By Use Case](https://www.trustkeith.co/solutions/use-case) - [By Privacy Regulation](https://www.trustkeith.co/solutions/regulations) - [How it works](https://www.trustkeith.co/how-it-works) - [Customers](https://www.trustkeith.co/customers) - [Pricing](https://www.trustkeith.co/pricing) - [Resources](https://resources.trustkeith.co) - [Company](https://www.trustkeith.co/company) [![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f) [![Trust Keith](https://resources.trustkeith.co/hs-fs/hubfs/raw_assets/public/Trustkeith_March2023/images/trust_keith.png?width=500&name=trust_keith.png "Trust Keith")](https://www.trustkeith.co/) - Product - [Privacy OS](https://www.trustkeith.co/product/privacy-os) - [Dedicated DPO](https://www.trustkeith.co/product/dedicated-dpo) - [Automated Data Discovery](https://www.trustkeith.co/product/automated-data-discovery) - [Intelligent Workflows](https://www.trustkeith.co/product/intelligent-workflows) - [Staff Training](https://www.trustkeith.co/product/staff-training) - [Global Risks & Controls](https://www.trustkeith.co/product/global-risks-controls) - [Proportional Policies](https://www.trustkeith.co/product/proportional-policies) - [Monitoring & Reporting](https://www.trustkeith.co/product/monitoring-reporting) - Solutions - [By Industry](https://www.trustkeith.co/solutions/industry) - [By Team](https://www.trustkeith.co/solutions/team) - [By Use Case](https://www.trustkeith.co/solutions/use-case) - [By Privacy Regulation](https://www.trustkeith.co/solutions/regulations) - [How it works](https://www.trustkeith.co/how-it-works) - [Customers](https://www.trustkeith.co/customers) - [Pricing](https://www.trustkeith.co/pricing) - [Resources](https://resources.trustkeith.co) - [Company](https://www.trustkeith.co/company) [![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f) [![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f) ![Menu Icon](https://resources.trustkeith.co/hubfs/raw_assets/public/Trustkeith_March2023/images/icon-menu.svg) ![Menu close](https://resources.trustkeith.co/hubfs/raw_assets/public/Trustkeith_March2023/images/icon-x.svg) ![](https://resources.trustkeith.co/hubfs/Resources%20Card%20template%2c%20Guides%20(57).png) # Records of Processing Activities: A Guide to Building and Maintaining Your ROPA Published by [Trust Keith](https://resources.trustkeith.co/author/trust-keith) on Oct 13, 2026, 5:04:00 PM **Quick answer** A ROPA (record of processing activities) is a written inventory of what personal data your business handles, why, who sees it, how long you keep it and how it's protected. [Article 30 of UK GDPR](https://gdpr-info.eu/art-30-gdpr/) requires it, and most scaling businesses can't rely on the small-company exemption. Build it by mapping data flows team by team, then keep it alive with a named owner and regular reviews. **Contents** - •  [Why a ROPA Matters Beyond Legal Compliance](https://resources.trustkeith.co/ropa-uk-gdpr-how-to-build-and-maintain-one-trust-keith#why-a-ropa-matters-beyond-legal-compliance) - •  [What Article 30 UK GDPR Actually Requires](https://resources.trustkeith.co/ropa-uk-gdpr-how-to-build-and-maintain-one-trust-keith#what-article-30-uk-gdpr-actually-requires) - •  [Who Needs a ROPA (and the Exemption That Rarely Applies)](https://resources.trustkeith.co/ropa-uk-gdpr-how-to-build-and-maintain-one-trust-keith#who-needs-a-ropa-and-the-exemption-that-rarely-applies) - •  [What Your ROPA Must Contain, Field by Field](https://resources.trustkeith.co/ropa-uk-gdpr-how-to-build-and-maintain-one-trust-keith#what-your-ropa-must-contain-field-by-field) - •  [How to Build a ROPA From Scratch](https://resources.trustkeith.co/ropa-uk-gdpr-how-to-build-and-maintain-one-trust-keith#how-to-build-a-ropa-from-scratch) - •  [Common ROPA Mistakes](https://resources.trustkeith.co/ropa-uk-gdpr-how-to-build-and-maintain-one-trust-keith#common-ropa-mistakes) - •  [Keeping Your ROPA Up to Date (and Using It in Due Diligence)](https://resources.trustkeith.co/ropa-uk-gdpr-how-to-build-and-maintain-one-trust-keith#keeping-your-ropa-up-to-date-and-using-it-in-due-diligence) - •  [Frequently Asked Questions](https://resources.trustkeith.co/ropa-uk-gdpr-how-to-build-and-maintain-one-trust-keith#faq) --- ## **Why a ROPA Matters Beyond Legal Compliance** Nobody gets excited about a spreadsheet, but a ROPA is the closest thing your business has to a map of where personal data actually lives, and almost every other privacy task depends on it. Want to answer a subject access request? You need to know where to look. Assessing a new supplier? You need to know what data they'd touch. Facing a breach at 4pm on a Friday? You need to know what was in the system that just got hit. Without a ROPA, each of those becomes a scramble. With one, they're a lookup. It also matters commercially. Investors, enterprise customers and acquirers all ask the same early question: do you know what data you hold and why? A current, honest ROPA is a fast, credible answer.  So yes, it's a legal requirement. It's also one of the most practical things a growing business can build. ### **What a ROPA does for you day to day** Think of it as the answer key. Retention reviews? Start with the ROPA. Planning to roll out a new AI tool? The ROPA shows what data it could touch. Onboarding a supplier? Check whether the activity's already recorded and who else already has access. It also exposes the awkward stuff early. Data kept for years with no reason. Suppliers nobody remembers signing off. Teams collecting more than they use. Better to find those yourself on a quiet Tuesday, than have a regulator or a customer find them for you. And because the ICO can ask to see it, the ROPA is often one of the first documents requested in an investigation. Having it ready, accurate and owned by a real person sends a very different signal from handing over something hastily assembled that morning. --- ## **What Article 30 UK GDPR Actually Requires** Let's start with the source. [Article 30](https://gdpr-info.eu/art-30-gdpr/) says that controllers, and separately processors, must keep a record of their processing activities. Three details are worth knowing. - **It must be written**, but electronic is fine. A shared spreadsheet or a platform both count. - **It must be available on request**. If the ICO asks to see it, you hand it over. No "we'll get back to you in a few weeks." - **Controllers and processors have different lists**. If your business decides why and how data is used, that's the controller list. If you process data on someone else's behalf, you also keep a processor record. Plenty of scale-ups do both. The regulator treats this as a core accountability measure. The ICO's guidance on [records of processing and lawful basis](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/records-of-processing-and-lawful-basis/) is blunt that it expects documentation to be accurate, complete and actually used, not just created once and forgotten. [![Trust Keith Office Hours](https://resources.trustkeith.co/hs-fs/hubfs/Blog%20Banners%20(21).png?width=2048&height=400&name=Blog%20Banners%20(21).png)](https://resources.trustkeith.co/office-hours) --- ## **Who Needs a ROPA (and the Exemption That Rarely Applies)** So, are you required to have one? Almost certainly. Article 30 includes an exemption for organisations with fewer than 250 employees. It sounds like a get-out for most scale-ups. It isn't, because the exemption falls away if any of these apply: - The processing is likely to result in a risk to people's rights and freedoms. - The processing isn't occasional. Payroll, customer accounts and marketing lists are everyday, ongoing activity. - You process special category data or criminal offence data. Run a business with regular customers and staff, and the second condition alone usually knocks the exemption out. Add health, biometric or similar data, as plenty of healthtechs and HR platforms do, and it's gone entirely. The ICO's page on [who needs to document their processing activities](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/who-needs-to-document-their-processing-activities/) walks through the same logic. The safe working assumption: you need a ROPA, so build one. --- ## **What Your ROPA Must Contain, Field by Field** This is where people expect a monster. It's actually a short list. For each processing activity, a controller's record needs: - **Who's responsible**: your organisation's name and contact details, plus any joint controller, representative or DPO. - **Purposes**: why you're processing the data, in plain terms. "Paying staff" beats "HR administration." - **Categories of people and data**: who the data's about (customers, employees, applicants) and what type (contact details, payment data, health information). - **Recipients**: who you share it with, including suppliers and anyone outside the UK. - **International transfers**: where data goes overseas and what safeguards cover it. - **Retention**: how long you keep it, where that's possible to set out. - **Security measures**: a general description of the technical and organisational protections in place. Strictly speaking, the lawful basis isn't one of the Article 30 fields. In practice, it's worth recording anyway, along with where the data came from. It saves you digging it out again when a regulator, a customer or a data subject asks. ### **One row per activity, not per system** A common trap. Your CRM isn't an activity. "Managing sales leads" is. One system might support five activities, and one activity might touch four systems. Record the activity, then list the systems against it. --- ## **How to Build a ROPA From Scratch** Staring at an empty template is the worst way to start. Here's a route that works better. ### **Step 1: Start with teams, not systems** Book a short conversation with each function: people, finance, sales, marketing, product, support, engineering. Ask three questions. What personal data do you handle? What do you use it for? Who else gets it? People describe their work more naturally than they describe their tooling. ### **Step 2: List your processing activities** Turn those conversations into a list of activities. Recruitment. Payroll. Customer onboarding. Product analytics. Support tickets. Email marketing. Expect somewhere between 15 and 40 for a business of this size. ### **Step 3: Fill in the Article 30 fields** Work through the field list above for each activity. Don't chase perfection on the first pass. Aim for accurate and honest, and flag the gaps. "Retention period unknown, to confirm with finance" is a perfectly good entry. Pretending it's six years when nobody's checked isn't. ### **Step 4: Cross-check against suppliers and contracts** Every supplier receiving personal data should show up as a recipient. If a tool appears in your finance records but not in your ROPA, you've found a gap. Where a supplier acts as a processor, you'll also need the right contract terms under [Article 28](https://gdpr-info.eu/art-28-gdpr/). Our guide to [managing your supplier chain](https://resources.trustkeith.co/supplier-gdpr-compliance-dpa-requirements-audit-guide) covers that side. ### **Step 5: Assign an owner** One named person is accountable for the ROPA. Each activity also has a business owner who can confirm the details. Shared ownership with no names attached means nobody updates it. [![Trust Keith Resources](https://resources.trustkeith.co/hs-fs/hubfs/Blog%20Banners%20(12).png?width=3584&height=700&name=Blog%20Banners%20(12).png)](https://www.trustkeith.co/resources) --- ## **Common ROPA Mistakes** Most ROPAs that fall apart do so in the same handful of ways. - **Built once, filed forever**. A ROPA that's accurate on the day it's written and wrong six months later is arguably worse than none. It gives false comfort. - **Too vague to be useful**. "Customer data" as a category tells nobody anything. Say what's in it. - **Written by one person in isolation**. If the people doing the work haven't been asked, the record describes how the process is supposed to work, not how it does. - **Missing the shadow tools**. The free trial someone signed up to in March. The spreadsheet of candidates in a personal drive. Those are exactly the things a regulator or auditor finds. - **Ignoring the processor side**. If you handle data on behalf of customers, that needs its own record. - **Copying a generic template wholesale**. Templates are a fine starting structure. They're not a description of your business. It's worth saying plainly: an incomplete ROPA that's honestly flagged is far better than a polished one that's wrong. ### **The "who actually reads this?" problem** Here's a subtler mistake. The ROPA gets written for the regulator, in careful language, and nobody inside the business ever opens it. Then it can't do the useful jobs. Write it so a colleague in sales or product can read an entry and recognise their own work. If they can't, the record's too abstract, and it'll drift out of date because nobody feels it's theirs. ### **Retention that's a wish, not a fact** Retention is where honesty matters most. Writing "as long as necessary" in every row looks tidy but says nothing. Pick real periods, tie them to a reason such as a tax rule or a contract term, and then check the systems actually delete or archive on schedule. A stated period that nothing enforces is a promise you're not keeping, and it's far easier to spot than you'd think. --- ## **Keeping Your ROPA Up to Date (and Using It in Due Diligence)** Growth changes the maths. New product, new supplier, new market, new team. Each one can add or change a processing activity. The fix is to hook the ROPA into things that already happen, rather than relying on someone remembering. - **Procurement**: no new tool that handles personal data goes live until it's been added. - **Product and engineering**: new features that use personal data trigger a ROPA check, and where risk is high, a DPIA under [Article 35](https://gdpr-info.eu/art-35-gdpr/). - **Quarterly review**: each business owner confirms their activities still look right. It takes minutes when it's routine. - **Incident reviews**: after any breach or near miss, check the record matched reality. ### **What good maintenance looks like in practice** Picture a scale-up that adds a new analytics tool in March. Procurement flags it, the product owner confirms what data it collects, and the ROPA gets a new line with the supplier, the transfer safeguards and the retention period. Ten minutes, done. Now picture the same business without the habit. Six months on, the tool's everywhere and nobody can say what it holds. Same company, very different afternoon when a customer asks. ### **Using it in due diligence** When a customer's security team, an investor or an acquirer starts asking about data protection, the ROPA is usually the first thing on the list. A current record shows you know your data flows, your suppliers are tracked and your retention isn't guesswork. Our guide to [preparing for privacy due diligence](https://resources.trustkeith.co/how-to-prepare-for-privacy-due-diligence-a-practical-guide-for-uk-scale-ups) shows what else tends to get asked. --- ## **Frequently Asked Questions** ### **What does ROPA stand for?** Record of Processing Activities. Some people also call it a data inventory, a data map or an Article 30 record. They overlap heavily, but the ROPA is the formal, documented version the law requires. ### **Is a ROPA a legal requirement under UK GDPR?** Yes. Article 30 requires controllers and processors to keep one. The small-organisation exemption only applies if processing is occasional, low risk and excludes special category and criminal offence data, so it rarely helps a growing business. ### **What's the difference between a ROPA and a data map?** A data map usually shows how data flows between systems and teams, often visually. A ROPA is the structured written record of each activity and its details. A good data map makes a ROPA much easier to build and keep accurate. ### **How often should a ROPA be updated?** Whenever processing changes, and reviewed at least quarterly or twice a year. Linking updates to procurement, product launches and incident reviews keeps it current without relying on memory. ### **Who's responsible for the ROPA?** The organisation is legally responsible. Day to day, one named person should own it, often the DPO or whoever leads privacy, with business owners confirming the details for their own activities. --- ## Does a ROPA Have to Be in a Spreadsheet? Short answer: no. Nothing in Article 30 says it has to live in Excel or Google Sheets. The law asks for a written record, and electronic is fine. The spreadsheet is just where everyone ends up by default. And plenty of people hate it. Ask around and you’ll hear the same gripes: - **It gets messy fast.** Forty activities, a dozen columns and a few tabs later, nobody wants to scroll through it, let alone edit it. - **It’s hard to find anything.** Which activities involve a particular supplier? Which ones send data overseas? Good luck, unless you enjoy filtering and squinting. - **Nobody keeps it up to date.** It sits in a folder, gets opened when someone asks for it, and drifts further from reality each month. - **It doesn’t connect to anything.** Your suppliers, your DPIAs and your ROPA all live in separate places, so every change means updating three documents and hoping you remembered. - **It looks like a mess.** Not a great thing to share with a customer’s security team or an investor mid-due-diligence. That’s exactly why Trust Keith builds the ROPA into the platform instead. Everything’s organised in one clean place. You can search it, filter it and tag it, so finding every activity that touches a particular supplier or data type takes seconds. It’s easy to read, easy to update and tidy enough to hand over without apologising for it. And because it sits alongside your data map, suppliers and DPIAs, a change in one place doesn’t mean a scavenger hunt across five documents. Your dedicated privacy expert is there to keep it accurate, so it stays a living record rather than a file nobody dares open. If you’re tired of wrestling with a spreadsheet, or you’d like to see what a ROPA looks like when it’s actually pleasant to use, you’re welcome to book some time with our team. We’re happy to show you around. ## [![get in touch](https://resources.trustkeith.co/hs-fs/hubfs/get%20in%20touch%20cta.png?width=228&height=57&name=get%20in%20touch%20cta.png)](https://www.trustkeith.co/talk-to-us) [![Trust Keith - take data protection off your plate, for good](https://resources.trustkeith.co/hs-fs/hubfs/blog%20cta%20(5).png?width=3450&height=1150&name=blog%20cta%20(5).png)](https://www.trustkeith.co/)   ## Related Articles ## [How to Prepare for Privacy Due Diligence: A Practical Guide for UK Scale-Ups](https://resources.trustkeith.co/how-to-prepare-for-privacy-due-diligence-a-practical-guide-for-uk-scale-ups) Privacy due diligence has quietly become one of the most common blockers in funding rounds and... [Read More](https://resources.trustkeith.co/how-to-prepare-for-privacy-due-diligence-a-practical-guide-for-uk-scale-ups) ## [Third-Party Risk and Data Protection: Managing Your Supplier Chain](https://resources.trustkeith.co/supplier-gdpr-compliance-dpa-requirements-audit-guide) Quick answer: If you share personal data with a supplier, UK GDPR makes you responsible for... [Read More](https://resources.trustkeith.co/supplier-gdpr-compliance-dpa-requirements-audit-guide) ## [What Is GDPR? The Plain-English Guide for UK Business Leaders](https://resources.trustkeith.co/what-is-gdpr-a-guide-for-uk-business-leaders-trust-keith) Quick answer: GDPR is the UK and EU law that governs how organisations collect, use, and protect... [Read More](https://resources.trustkeith.co/what-is-gdpr-a-guide-for-uk-business-leaders-trust-keith) ## Curious how Trust Keith can help take data compliance off your plate? [![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f) [![Trust Keith](https://resources.trustkeith.co/hs-fs/hubfs/raw_assets/public/Trustkeith_March2023/images/trust_keith01.png?width=268&name=trust_keith01.png "Trust Keith")](https://www.trustkeith.co/) [![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f) - Features - [Comply with data regulations](https://www.trustkeith.co/product/comply-with-regulations) - [Discover your data risks](https://www.trustkeith.co/product/discover-data-risks) - [Expert Advice](https://www.trustkeith.co/product/expert-advice) - [Govern your data protection programme](https://www.trustkeith.co/product/govern-data-protection) - [Manage breaches and incidents](https://www.trustkeith.co/product/manage-breaches-and-incidents) - [Train your staff](https://www.trustkeith.co/product/train-your-staff) - Product - [How it works](https://www.trustkeith.co/how-it-works) - [Marketplace](https://www.trustkeith.co/marketplace) - [Pricing](https://www.trustkeith.co/pricing) - [Customers](https://www.trustkeith.co/customers) - Trust Keith - [Company](https://www.trustkeith.co/company) - [Talk to us](https://www.trustkeith.co/talk-to-us) - [LinkedIn](https://www.linkedin.com/company/trustkeith/) - [Privacy policy](https://trustkeith.trustkeith.co/) © Trust Keith 2026. Trust Keith Ltd is a company registered in England and Wales number 12283797. ```json { "@context" : "https://schema.org", "@id" : "https://resources.trustkeith.co/ropa-uk-gdpr-how-to-build-and-maintain-one-trust-keith#blogposting", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Trust Keith" }, "dateModified" : "2026-10-13T16:04:31+0000", "datePublished" : "2026-10-13T16:04:00+0000", "description" : "ROPA explained: what UK GDPR Article 30 requires, who needs one, what it must contain, and how to build and keep it current.", "headline" : "Records of Processing Activities: A Guide to Building and Maintaining Your ROPA", "inLanguage" : "en-GB", "isPartOf" : { "@id" : "https://resources.trustkeith.co/#blog", "@type" : "Blog", "name" : "Trust Keith Resources Blog", "publisher" : { "@id" : "https://www.trustkeith.co/#organization" } }, "mainEntityOfPage" : { "@id" : "https://resources.trustkeith.co/ropa-uk-gdpr-how-to-build-and-maintain-one-trust-keith", "@type" : "WebPage" }, "publisher" : { "@id" : "https://www.trustkeith.co/#organization", "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://cdn.prod.website-files.com/5f462e8160aa877216f7d4b7/642bcbad7735490755580d8d_trust-keith-logo.svg" }, "name" : "Trust Keith", "url" : "https://www.trustkeith.co/" } } ```