# ROPA and data-flow mapping worksheet

Use one activity record for each coherent processing purpose and maintain separate controller and processor records where both roles apply. Reconcile the records with actual systems and supplier arrangements.

Document edition 2 — 1 November 2026

Organisation / activity: 
Owner: 
Reference and version: 
Review date: 

## 1. Identify the activity and role

- State the activity and responsible legal entity. Distinguish controller, joint controller and processor work using the actual purposes and means.
- If relying on the under-250-employee exemption, test the particular activity for non-occasional processing, relevant risks and special-category or criminal-offence information.
- Assign an owner and a unique activity identifier.

Activity ID / title / business unit: 
Legal entity and role: 
Joint-controller arrangement if applicable: 
Accountable activity owner: 
Article 30 applicability or exemption reasoning: 
Version and review date: 

## 2. Complete the controller record

- Record controller, joint-controller, representative and DPO contact details as applicable.
- Describe purposes, categories of people and personal information, recipients and international transfers.
- Record envisaged erasure time limits and a general security description where possible; document any missing detail and an action to resolve it.

Controller / joint controller / representative / DPO contacts: 
Processing purposes: 
Categories of data subjects and personal data: 
Recipients and recipient categories: 
Transfers / destinations / safeguard references: 
Erasure time limits and security summary: 

## 3. Complete the separate processor record

- For services provided as a processor, identify each controller for whom processing is undertaken and relevant contact details.
- Record categories of processing carried out for each controller, transfers and the general security description where possible.
- Link the controller instructions, Article 28 terms and authorised subprocessors. Do not substitute the controller record for this separate record.

Processor / representative / DPO contacts: 
Each relevant controller and contacts: 
Categories of processing for each controller: 
Transfer countries and supporting documentation: 
General security description: 
Instructions / contract / subprocessor references: 

## 4. Map the data flow

- Trace each source through collection, storage, use, sharing and final deletion. Include spreadsheets, messaging, exports, paper and legacy copies.
- For each movement record who sends, who receives, the means, frequency, location and access control.
- Identify remote overseas access separately from the location of the storage server.

Flow ID / activity ID: 
Source or sender and collection point: 
System or repository / data categories: 
Recipient / receiving system / country: 
Transmission method / frequency / access: 
Deletion destination / backup lifecycle / diagram reference: 

## 5. Reconcile and maintain

- Check the flow against notices, lawful-basis records, retention schedule, DPIAs and supplier contracts. Record discrepancies.
- Useful supporting fields such as lawful basis are additional accountability information; distinguish them from the specific Article 30 fields.
- Update when purposes, recipients, systems or retention change; retain an appropriate version history.

Lawful basis and sensitive-data conditions reference: 
Privacy notice / retention / DPIA links: 
Supplier terms and transfer assessment links: 
Discrepancies and corrective actions: 
Change owner and update triggers: 
Last reconciliation evidence and next review: 

## Sources

- ICO: Documentation requirements: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/documentation/
- ICO: Who must document processing: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/who-needs-to-document-their-processing-activities/