Lion Cipher Lab

Build a Record of Processing Activities (RoPA) under GDPR Article 30

• GRC / Compliance
• Intermediate
• ~45 min
• Free · no account required

Why it matters

Almost every organisation that touches a customer, an employee or a website visitor processes personal data, and GDPR Article 30 requires most of them to keep a Record of Processing Activities - a RoPA: a written inventory of every processing activity, its purpose, whose data it uses, what data, who receives it, where it goes, how long it is kept and how it is protected. It is the first thing a regulator or auditor asks for, because it is the map of everything else. You cannot honour a data-subject's erasure request for data you cannot locate; you cannot scope a breach in 72 hours if you do…

What you'll learn

• what a Record of Processing Activities (RoPA) is and why GDPR Article 30 makes it mandatory
• the Article 30(5) under-250-employee exemption and why its carve-outs mean most orgs still keep one
• the exact fields a controller's record must capture under Article 30(1)
• the controller (Article 30(1)) vs processor (Article 30(2)) record distinction
• mapping each processing activity to an Article 6 lawful basis and flagging special-category data (Article 9)
• recording retention limits, recipients, and international transfers with their safeguards
• flagging which activities trigger a Data Protection Impact Assessment (Article 35)
• how a RoPA differs from a data-flow map and an asset inventory, and why it is the backbone for DSARs and breach response

Steps in this lab

1. What a RoPA is - and why Article 30 makes it mandatory
2. The 250-employee exemption trap, and controller vs processor records
3. The mandatory fields - what Article 30(1) requires in every row
4. Build the table - three worked rows for a small SaaS company
5. Retention, recipients, and international transfers - the columns people fudge
6. Flag the DPIA triggers - and the RoPA's handoff to DPIAs, DSARs and breach
7. RoPA vs data-flow map vs asset inventory - and the failure modes
8. What you produced, keeping it alive, and the UK GDPR split

Open the full interactive lab →