Record of processing activities template
The written record Article 30 of the UK GDPR asks for, as a spreadsheet with one row per processing activity - pre-filled with the HR activities almost every employer has, so you are editing rather than starting from nothing.
A record of processing activities (ROPA) is the written list, required by Article 30 of the UK GDPR, of what personal data an organisation processes, why, about whom, who receives it, where it goes and how long it is kept. Organisations with fewer than 250 employees are excused only for processing that is occasional, unlikely to result in a risk and free of special category or criminal offence data. Payroll and HR records are regular and include health data, so in practice every employer needs one for its staff data. The download has every Article 30 field and eight HR rows to edit.
Download the record CSV · opens in Excel, Numbers or Google Sheets
What must a record of processing activities contain?
Article 30(1) lists seven items for a controller. The download has a column for each, plus three that make the record usable.
| Article 30(1) | What the law asks for | Column |
|---|---|---|
| (a) | Name and contact details of the controller and, where applicable, the joint controller, representative and data protection officer | Recorded once, at the top of the file |
| (b) | The purposes of the processing | Purpose |
| (c) | The categories of data subjects and of personal data | People; Data held |
| (d) | The categories of recipients, including any in third countries | Shared with |
| (e) | Transfers to a third country or international organisation, and safeguards where required | Transfers outside the UK |
| (f) | Where possible, the time limits for erasure | Retention |
| (g) | Where possible, a general description of the security measures | Security |
| - | The lawful basis, and for special category data the condition relied on | Lawful basis; Special category condition |
| - | Where the data is held, and who is responsible | System; Owner |
The record must be kept "in writing, including in electronic form" and made available to the regulator on request. Since 30 September 2026 that regulator is the Information Commission, which replaced the Information Commissioner.
The lawful basis column is not in the Article 30 list, but for health data it is not optional either. Where you rely on the employment condition in Schedule 1 of the Data Protection Act 2018, paragraph 41 of that Schedule requires your Article 30 record to state the condition relied on, and you must also hold an appropriate policy document.
Do small businesses need a ROPA?
Usually, for staff data at least. Article 30(5) exempts organisations "employing fewer than 250 persons" unless the processing is likely to result in a risk to people's rights and freedoms, is not occasional, or includes special category data or criminal conviction data. The regulator's guidance puts it the other way round: if you employ fewer than 250 people, you "need only document processing activities that" are not occasional, are likely to result in a risk, or involve special category or criminal offence data.
Running payroll every month is not occasional. Recording sickness absence is special category data. A DBS check result is criminal offence data. So an employer of any size documents those activities, and most find it simpler to document everything.
Which HR activities go in the record?
The download is pre-filled with eight rows that almost every employer needs. Delete what does not apply, and add rows for anything else you do with personal data - customer records, marketing lists, CCTV.
- Recruitment - applications, interview notes, references, right to work checks.
- Employment administration - contracts, personnel files, emergency contacts.
- Payroll and pensions - pay, tax, National Insurance, bank details, pension enrolment.
- Absence and health - sickness records, fit notes, occupational health, adjustments.
- Performance and conduct - reviews, disciplinary and grievance files.
- Health and safety - the accident record and RIDDOR reports.
- Criminal record checks - DBS results for eligible roles.
- IT and building access - accounts, system logs, door access.
The retention column should match your HR data retention schedule, and the "Shared with" column should match the suppliers in your supplier register that process personal data.
How does the ROPA fit with your other documents?
- The privacy notice tells staff what the record tells the regulator. If the two disagree, one of them is wrong. See the employee privacy notice template.
- The retention schedule supplies column (f).
- The supplier register supplies the recipients and the processor contracts behind them.
- Subject access requests are much faster to answer from a good record, because it tells you every system to search. See subject access requests.
How do you keep it current?
- Give each row an owner, normally the person who runs that process.
- Update it when a system changes. A new payroll provider or HR system is a new recipient and possibly a new transfer.
- Review it yearly with the privacy notice and the retention schedule, and date each review.
- Keep the old versions. A dated history shows the record is maintained, not written once for an audit.
Frequently asked questions
What is a record of processing activities?
A written record, required by Article 30 of the UK GDPR, of the personal data an organisation processes: the purposes, the categories of people and data, the recipients, any transfers outside the UK, retention periods and security measures.
Do small businesses need a record of processing activities?
Usually yes, at least for staff data. The exemption for organisations with fewer than 250 employees does not cover processing that is regular, likely to result in a risk, or involves special category or criminal offence data, and payroll and sickness records fall into those categories.
What must a ROPA contain?
The controller's name and contact details, the purposes of processing, the categories of data subjects and personal data, the categories of recipients, any transfers outside the UK with their safeguards, and where possible the retention periods and a general description of security measures.
Does a ROPA have to include the lawful basis?
Article 30 does not list it, but where an employer relies on the employment condition in Schedule 1 of the Data Protection Act 2018 for health or other special category data, the record must state the condition relied on.
Who can ask to see a record of processing activities?
The regulator. Article 30 requires the record to be made available to it on request. Since 30 September 2026 the regulator is the Information Commission.
Sources
Checked against the primary source on 5 October 2026.
- UK GDPR, Article 30 - what the record must contain, the written form and the under-250 exemption
- ICO: what do we need to document under Article 30 - the documentation list
- ICO: who needs to document their processing activities - the limits of the under-250 exemption
- Data Protection Act 2018, Schedule 1, Part 4 - the appropriate policy document and the record of the condition relied on
- Data (Use and Access) Act 2025 (Commencement No. 9) Regulations 2026 - the Information Commission, from 30 September 2026
This is general guidance for UK employers and is not legal advice. Take advice on anything contested, unusual or expensive.
More to download: All 45 templates · 79 guides explaining the rules · 27 calculators
A record of processing that stays current
CoDash keeps a register of processing activities beside your policies and retention settings, so the record, the privacy notice and the data itself are maintained in one place.
Explore a live, safe sandbox