GDPR Article 30 ROPA Generator
Build a Record of Processing Activities compliant with GDPR Article 30. Captures every processing activity with controller, data categories, retention, international transfers, and security measures. Export as CSV, JSON, or Markdown.
Compliance Intelligence
Every organisation processing EU personal data needs a documented ROPA: most marketing teams don't have one.
Article 30 of the GDPR requires controllers and processors to maintain a written record of all processing activities. Supervisory authorities ask for it in audits. This generator uses the official ICO and CNIL template structure, pre-populated with the fields a marketing stack normally needs covered: web analytics, CRM, ad platforms, marketing automation, support tools.
Organisation details
Processing activities
Marketing stack presets: click to add
Generated ROPA
Record of Processing Activities
0 activities
Next steps
A ROPA alone isn't enough: high-risk activities need a DPIA
Profiling, large-scale monitoring, and new technology processing require a Data Protection Impact Assessment under GDPR Article 35.
Frequently asked questions
What is a ROPA?
Record of Processing Activities. GDPR Article 30 requires controllers and processors to maintain written records of every processing activity involving EU personal data.
Who needs a ROPA?
Any organisation processing EU/UK personal data in a non-occasional way. Small-scale occasional processors under 250 employees have exemptions, but they rarely apply in practice.
What goes in a ROPA?
For each activity: purpose, legal basis, data subjects, data categories, recipients, international transfers, retention period, and security measures. Article 30 lists all of these.
Who is the controller vs the processor?
The controller decides why and how data is processed. The processor acts on the controller's instructions. Your SaaS vendors are processors; you are usually the controller.
What are the six legal bases under Article 6?
Consent, contract performance, legal obligation, vital interests, public task, and legitimate interests. Pick the right one for each activity.
Does ROPA need to be submitted to the authority?
No, not by default. You must produce it on request during an audit. Fines for not having one can hit €10M or 2% of global turnover.
How often should ROPA be reviewed?
At least annually and whenever you add a new processing activity or vendor. Many organisations review quarterly.
Is a spreadsheet enough?
Yes if maintained. Many sophisticated regulators (ICO, CNIL) expect something like what this tool produces.
Do I need separate ROPAs for the UK and EU?
Not necessarily. One ROPA covering both is fine if it clearly flags transfers and relevant national law.
What is "data minimisation"?
A GDPR principle requiring you to collect only the personal data necessary for the stated purpose. The ROPA should show you've applied this.
Can I include a ROPA for processors we hired?
Processors maintain their own ROPAs. Your ROPA should name them as recipients, not duplicate their records.
What is a DPIA and how is it different?
A Data Protection Impact Assessment (Article 35) is a deeper risk assessment required for high-risk processing. Separate document, different trigger. See the DPIA generator on this site.
Free · no account
SEORCE for Chrome, Edge and Firefox
Audits the page you are on: headings, meta tags, schema, indexability, and whether AI crawlers can read it. Export the result as a PDF. Free, with no account.
It audits one page at a time and does not track AI answers. About the extension
For teams and agencies
The whole job of search and AI, in one platform.
Rankings, AI visibility, technical fixes, content and reporting sit in one project. Reports export to Excel, PDF and Google Sheets on a schedule, and pricing is per project, never per seat.
3,000+ users · Free forever plan, no card needed