What this review helps you do
A record of processing activities should describe the processing that actually happens. Build it from systems, staff workflows and supplier relationships, then connect each activity to its purposes, information, recipients, retention decisions and security evidence so that future changes are easy to trace.
AT A GLANCE
Keep one maintainable view of what personal information your organisation uses, why it uses it, where it goes and when it should be deleted.
Who should use this review?
Controllers and processors of all sizes, including organisations with routine staff, customer, patient or client processing.
What to review
- Document controller contacts, purposes, people and information categories, recipients, transfers, retention and security, as applicable.
- For processor work, keep the separate Article 30(2) record covering each controller and categories of processing performed.
- Reconcile the register with real systems, supplier terms, privacy information and deletion rules.
- Assign an owner and update triggers; add useful links to lawful bases, DPIAs, breach records and special-category conditions.
Working outputs
- Maintainable controller ROPA spreadsheet.
- Separate processor ROPA where relevant.
- Data-flow map and reconciliation actions.
PUT THIS GUIDE TO WORK
Review it. Record it. Keep the evidence.
Open the relevant assessment area or complete the matching working document.
Evidence checklist
Use these checks to gather references and identify the evidence that still needs testing.
Have routine and sensitive processing activities been captured?
Evidence to look for: Activity inventory covering staff, customers and other affected people.
If it is missing: Inventory all processing before claiming an exemption.
Does the controller record contain the applicable Article 30(1) fields?
Evidence to look for: Purposes, data categories, recipients, transfers, retention and security.
If it is missing: Complete missing fields and link supporting evidence.
Is a separate processor record maintained where required?
Evidence to look for: Article 30(2) entries for processing performed for other controllers.
If it is missing: Identify processor services and document each controller relationship.
Does someone review the register when systems or purposes change?
Evidence to look for: Owner, version history and last review date.
If it is missing: Assign an owner and change-review process.
Apply the limits carefully
For fewer than 250 employees, document activities that are not occasional, create the relevant risk to rights and freedoms, or involve special-category or criminal-offence data.
Do not treat organisation size alone as an exemption. Controller and processor records have different mandatory fields.
Common misunderstandings
Having fewer than 250 employees is not a blanket exemption from keeping processing records. The exemption is limited and assessed by activity; routine HR and customer processing will commonly need to be documented.
Worked example: finding a payroll export outside the register
Illustrative scenario. This is a fictional teaching example, not a client case, professional finding or verified outcome.
A fictional employer records its payroll platform in the ROPA. During a walkthrough, finance staff explain that they also export a spreadsheet to a shared folder each month.
- Control
The processing record and data-flow map should reflect routine exports as well as the main application.
- Evidence
Inspect a blank export layout, folder access settings, payroll workflow and the relevant supplier agreement. Use record references rather than copying employees' details into the audit.
- Finding
The export contains more fields than finance needs, and the ROPA does not explain this copy's access or retention.
- Owner and action
The payroll owner documents the flow, reviews necessary fields with finance and aligns the copy with approved access and retention rules.
- Verification
Check a later export and its access list, confirm the disposal process and update the ROPA version and linked evidence.
Practical questions
Should every system have its own ROPA row?
Choose a structure that makes the purpose and processing understandable. A single activity can use several systems, and one system can support several purposes. Link the activity record to a systems inventory rather than forcing them to match one for one.
How do we keep the register current?
Assign an activity owner and connect updates to real changes: new suppliers, fields, purposes, recipients or retention rules. Keep a short change record and check affected notices, contracts and assessments at the same time.
Official sources
- ICO — Documentation (opens in a new tab)
- ICO — Who needs to document processing? (opens in a new tab)
Source-linked editorial review: 1 November 2026. Guidance supports a documented process. It does not replace advice about your particular circumstances or verify your organisation’s compliance.
Content update — 2 November 2026: added an illustrative evidence record, practical questions and related guidance. The existing legal-source baseline is 1 November 2026.