GDPR.ME.UK · WORKING DOCUMENT 70

ROPA and data-flow mapping worksheet

Use one activity record for each coherent processing purpose and maintain separate controller and processor records where both roles apply. Reconcile the records with actual systems and supplier arrangements.

Document edition 2 · 1 November 2026 · Adapt to your processing and evidence. Use references rather than personal records.

Use alongside the records of processing guide and evidence-to-action method.

Record details

Organisation or activity reference

Responsible owner or role

Record reference and version

Review date

1. Identify the activity and role

State the activity and responsible legal entity. Distinguish controller, joint controller and processor work using the actual purposes and means.
If relying on the under-250-employee exemption, test the particular activity for non-occasional processing, relevant risks and special-category or criminal-offence information.
Assign an owner and a unique activity identifier.

Activity ID / title / business unit

Legal entity and role

Joint-controller arrangement if applicable

Accountable activity owner

Article 30 applicability or exemption reasoning

Version and review date

2. Complete the controller record

Record controller, joint-controller, representative and DPO contact details as applicable.
Describe purposes, categories of people and personal information, recipients and international transfers.
Record envisaged erasure time limits and a general security description where possible; document any missing detail and an action to resolve it.

Controller / joint controller / representative / DPO contacts

Processing purposes

Categories of data subjects and personal data

Recipients and recipient categories

Transfers / destinations / safeguard references

Erasure time limits and security summary

3. Complete the separate processor record

For services provided as a processor, identify each controller for whom processing is undertaken and relevant contact details.
Record categories of processing carried out for each controller, transfers and the general security description where possible.
Link the controller instructions, Article 28 terms and authorised subprocessors. Do not substitute the controller record for this separate record.

Processor / representative / DPO contacts

Each relevant controller and contacts

Categories of processing for each controller

Transfer countries and supporting documentation

General security description

Instructions / contract / subprocessor references

4. Map the data flow

Trace each source through collection, storage, use, sharing and final deletion. Include spreadsheets, messaging, exports, paper and legacy copies.
For each movement record who sends, who receives, the means, frequency, location and access control.
Identify remote overseas access separately from the location of the storage server.

Flow ID / activity ID

Source or sender and collection point

System or repository / data categories

Recipient / receiving system / country

Transmission method / frequency / access

Deletion destination / backup lifecycle / diagram reference

5. Reconcile and maintain

Check the flow against notices, lawful-basis records, retention schedule, DPIAs and supplier contracts. Record discrepancies.
Useful supporting fields such as lawful basis are additional accountability information; distinguish them from the specific Article 30 fields.
Update when purposes, recipients, systems or retention change; retain an appropriate version history.

Lawful basis and sensitive-data conditions reference

Privacy notice / retention / DPIA links

Supplier terms and transfer assessment links

Discrepancies and corrective actions

Change owner and update triggers

Last reconciliation evidence and next review

Sources and completion

Record who reviewed and approved the document. Save a working copy to reopen it later, or export the completed HTML record. Your entries stay in this page; automatic storage is not enabled. A downloaded record may contain sensitive operational information.

The template does not verify facts, perform an audit, submit a notification or execute a contract.