Build your record of processing activities
Use the nine-step wizard or a single form to keep your Article 30 record, review it every six months and export it.
GDPR Article 30 requires each controller and its representative to keep a record of the processing activities under its responsibility, and Article 30(4) has that record made available to the supervisory authority on request. The RoPA tab of Compliance › Privacy, headed Records of Processing Activities, is that record.
Create entries with the wizard
Select Create with wizard →. The wizard has nine steps:
| Step | What you answer |
|---|---|
| Data subjects | Whose personal data the activity processes, from the list or in your own words |
| Personal data | The fields each group of data subjects provides |
| Purposes | What you process the data for. Each purpose becomes its own entry, for every group of data subjects |
| Legal basis | The Article 6 basis and the risk level for the entries, and an Article 9 condition if special-category data is involved. High-risk activities are flagged for a DPIA |
| Recipients | Who else gets the data: a vendor from your sub-processor register, or an internal team, partner or authority |
| Retention | How long the data is kept |
| Security measures | The technical and organisational measures protecting the data |
| International transfers | Whether personal data leaves the EU/EEA |
| Review & save | Your role (Controller, Joint controller or Processor) and the entries about to be created |
Use Next and Previous to move between steps; the last step's button, such as Create 6 activities, creates the entries. The answers the wizard asks once, such as the basis, risk, retention, recipients, transfers and your role, go on every entry it creates. Change any entry afterwards from its own record.
Add or copy a single entry
Add activity opens Register a processing activity, for one entry at a time. To start from an existing entry, choose Duplicate from its row's menu: the same form opens filled in from that entry, and nothing is saved until you submit it.
Keep it current
Open an entry to work on it. Its status is Active, Under review or Archived.
- Mark reviewed records today as the last review. The next review falls due 180 days later, and an entry under review returns to Active. The Review overdue tile counts entries past their date.
- Mark under review flags an entry for another look. It stays on the register while it's flagged.
- Edit details, in the drawer's menu, changes what the entry records.
- Add recipient and Add transfer record who receives the data and any transfer outside the EU/EEA, with its safeguard: Adequacy decision, Standard Contractual Clauses, Binding Corporate Rules or Article 49 derogation.
- A high-risk entry with no live impact assessment linked to it shows Needs DPIA. See Run a DPIA.
This can't be undone. Archive takes an entry off the active register. Its recipients, transfers and history stay on file, read-only, and an archived entry can't be brought back.
Export Article 30
Export Article 30 downloads the record as a CSV named after the day, such as article-30-2026-11-04.csv, with one row per entry and these columns: Name, Purpose, Legal basis, Data subjects, Data categories, Recipients, Transfers, Retention, Security measures, Controller role, Risk, Status, Last reviewed and Review due.
The file holds the register's own values, such as legitimate_interests for a legal basis, and lists every entry with its status, archived ones included. One export carries up to 100 entries; a larger record is refused rather than cut short.