Record of Processing Activities (RoPA) — template GDPR Art. 30

See our article RoPA. Mandatory content per processing (Art. 30(1)): name + contact controller + DPO, purposes, categories of subjects + personal data, recipients (incl. third countries), retention periods, security measures, international transfer with safeguards. For processor (Art. 30(2)): name + contact controller + processor + DPO, processing categories, transfer, security. "<250 employees" exemption: often falls away in practice. Allowed ONLY if no risk + non-incidental + no Art. 9 data + no criminal data. In practice = every Dutch SMB bakery, webshop, or HR consultancy with customer data must have RoPA. Formats: Excel (simple, free), Notion database (collaborative), SaaS tool (OneTrust, Securiti — overkill for SMB). AP has a free Excel template. Updating: per new tool, new purpose, or annual review. For AP audit: within 30 days of request you must be able to produce RoPA. How big? Small freelancer: 5-10 entries. SMB: 20-50. Large: 100+. Common mistakes: RoPA "done" and then not updated + missing sub-processors + forgetting to mention international transfer. Fine for missing: Art. 83(4) — up to €10m / 2%.