Records of Processing Activities (RoPA) – Controller Template (English)
Purpose
This skill provides a ready-to-use English-language template for the Records of Processing Activities (RoPA) of a controller pursuant to Article 30(1) GDPR. It is intended for German law firms, in-house counsel, and data protection officers who need to provide a RoPA in English to international clients, US group entities, or supervisory authorities in cross-border investigations.
When you need this skill
- A multinational client requires an English-language RoPA.
- A US parent company asks for the EU subsidiary's processing records.
- A supervisory authority requests the RoPA in English in a cross-border case.
- A vendor audit (SOC 2, ISO 27001) reviews the RoPA.
- A first-time build of a RoPA in an internationally facing organisation.
Legal framework
Article 30(1) GDPR requires the controller to maintain a record containing:
a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative, and the Data Protection Officer;
b) the purposes of the processing;
c) a description of the categories of data subjects and of the categories of personal data;
d) the categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organisations;
e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;
f) where possible, the envisaged time limits for erasure of the different categories of data;
g) where possible, a general description of the technical and organisational measures referred to in Article 32(1) GDPR.
Article 30(3) requires written or electronic form; Article 30(4) makes the RoPA available to the supervisory authority on request; Article 30(5) provides a narrow SME exemption that rarely applies in practice.
/ Checklist
- Fill in the cover sheet with controller details, representative (if applicable), and DPO.
- One row per processing activity (one business process = one row).
- Populate the seven mandatory columns.
- For third-country transfers, identify the transfer tool (Adequacy Decision, SCCs, BCRs, DPF).
- State retention periods concretely; avoid "as required by law".
- Keep TOMs in a separate annex; reference only.
- Add a versioning footer.
- Schedule annual review.
Template
Cover Sheet
Controller: [Company / Firm Name]
Address: [...]
Representative (Art. 27): [if applicable]
Data Protection Officer: [Name, contact]
Supervisory Authority: [competent DPA]
Created: [date]
Last amended: [date]
Version: [v1.0]
Table (mandatory columns)
| No. |
Processing activity |
Purpose |
Legal basis |
Categories of data subjects |
Categories of personal data |
Categories of recipients |
Third country / safeguards |
Retention period |
TOM reference |
| 1 |
HR administration |
Establishment, performance, and termination of employment |
Art. 6(1)(b) GDPR; Sec. 26 BDSG |
Employees, applicants |
Master data, contract data, payroll, sick leave |
Social security, tax authority, payroll provider |
none |
10 years after termination (Sec. 257 HGB, Sec. 147 AO); applicants 6 months |
TOM Annex 1, 3, 5 |
| 2 |
Client matter administration |
Engagement, performance, and billing of legal services |
Art. 6(1)(b) and (f) GDPR; Sec. 50 BRAO |
Clients, opposing parties, witnesses |
Master data, correspondence, briefs, fee data |
Courts, authorities, opposing counsel, insurers |
none |
6 years after end of mandate (Sec. 50(1) BRAO); tax-relevant documents 10 years |
TOM Annex 1, 2, 4, 6 |
| 3 |
Website contact form |
Responding to inquiries |
Art. 6(1)(b) or (f) GDPR |
Prospective clients |
Name, email, phone, message |
Hosting provider (DPA in place) |
none |
6 months after closure |
TOM Annex 1, 5 |
| 4 |
CRM sales |
Customer relationship, business development |
Art. 6(1)(b) and (f) GDPR |
Existing customers, prospects |
Master data, contact history, revenue data |
CRM SaaS provider (USA) |
USA – EU-US Data Privacy Framework (active listing on file, see DPF Annex) |
3 years after last contact |
TOM Annex 1, 2, 5 |
Versioning footer
Version 1.0 – Initial draft – [date, author]
Version 1.1 – [change] – [date, author]
Common mistakes
- Mixing "purpose" and "legal basis" in one column.
- Listing individual recipients ("Ms. Smith, accountant") instead of categories ("Tax advisory firms").
- Stating "USA" without naming the transfer tool.
- Generic retention "10 years" without differentiation by data category.
- Copying the full Art. 32 wording into the TOM column instead of referring to a TOM annex.
- Failing to list a DPO where one is mandatory under Sec. 38 BDSG.
Cross-references
ropa-art-30-dsgvo-grundlagen for the German-language framework.ropa-en-processor-template for the processor counterpart.ropa-konzernumlauf-und-multi-entity for multi-entity groups.dpa-en-template-controller-processor for English DPA templates.tia-en-template-full for the English Transfer Impact Assessment template.
Sources as of 06/2026
- Regulation (EU) 2016/679 (GDPR), in particular Article 30(1), Recitals 13 and 82.
- BDSG (German Federal Data Protection Act), Sec. 26, 38.
- BRAO (Federal Lawyers' Act), Sec. 50.
- HGB Sec. 257; AO Sec. 147.
- DSK Short Paper No. 1 "Records of Processing Activities" (Status 17 December 2018).
- EDPB Position Paper on Article 30(5) GDPR (19 April 2018).
1---2name: ropa-en-controller-template3description: Für Records of Processing Activities (RoPA) – Controller Template (English): ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.4---56# Records of Processing Activities (RoPA) – Controller Template (English)78## Purpose910This skill provides a ready-to-use English-language template for the Records of Processing Activities (RoPA) of a controller pursuant to Article 30(1) GDPR. It is intended for German law firms, in-house counsel, and data protection officers who need to provide a RoPA in English to international clients, US group entities, or supervisory authorities in cross-border investigations.1112## When you need this skill1314- A multinational client requires an English-language RoPA.15- A US parent company asks for the EU subsidiary's processing records.16- A supervisory authority requests the RoPA in English in a cross-border case.17- A vendor audit (SOC 2, ISO 27001) reviews the RoPA.18- A first-time build of a RoPA in an internationally facing organisation.1920## Legal framework2122Article 30(1) GDPR requires the controller to maintain a record containing:2324a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative, and the Data Protection Officer;25b) the purposes of the processing;26c) a description of the categories of data subjects and of the categories of personal data;27d) the categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organisations;28e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;29f) where possible, the envisaged time limits for erasure of the different categories of data;30g) where possible, a general description of the technical and organisational measures referred to in Article 32(1) GDPR.3132Article 30(3) requires written or electronic form; Article 30(4) makes the RoPA available to the supervisory authority on request; Article 30(5) provides a narrow SME exemption that rarely applies in practice.3334## / Checklist35361. Fill in the cover sheet with controller details, representative (if applicable), and DPO.372. One row per processing activity (one business process = one row).383. Populate the seven mandatory columns.394. For third-country transfers, identify the transfer tool (Adequacy Decision, SCCs, BCRs, DPF).405. State retention periods concretely; avoid "as required by law".416. Keep TOMs in a separate annex; reference only.427. Add a versioning footer.438. Schedule annual review.4445## Template4647### Cover Sheet4849```50Controller: [Company / Firm Name]51Address: [...]52Representative (Art. 27): [if applicable]53Data Protection Officer: [Name, contact]54Supervisory Authority: [competent DPA]55Created: [date]56Last amended: [date]57Version: [v1.0]58```5960### Table (mandatory columns)6162| No. | Processing activity | Purpose | Legal basis | Categories of data subjects | Categories of personal data | Categories of recipients | Third country / safeguards | Retention period | TOM reference |63|---|---|---|---|---|---|---|---|---|---|64| 1 | HR administration | Establishment, performance, and termination of employment | Art. 6(1)(b) GDPR; Sec. 26 BDSG | Employees, applicants | Master data, contract data, payroll, sick leave | Social security, tax authority, payroll provider | none | 10 years after termination (Sec. 257 HGB, Sec. 147 AO); applicants 6 months | TOM Annex 1, 3, 5 |65| 2 | Client matter administration | Engagement, performance, and billing of legal services | Art. 6(1)(b) and (f) GDPR; Sec. 50 BRAO | Clients, opposing parties, witnesses | Master data, correspondence, briefs, fee data | Courts, authorities, opposing counsel, insurers | none | 6 years after end of mandate (Sec. 50(1) BRAO); tax-relevant documents 10 years | TOM Annex 1, 2, 4, 6 |66| 3 | Website contact form | Responding to inquiries | Art. 6(1)(b) or (f) GDPR | Prospective clients | Name, email, phone, message | Hosting provider (DPA in place) | none | 6 months after closure | TOM Annex 1, 5 |67| 4 | CRM sales | Customer relationship, business development | Art. 6(1)(b) and (f) GDPR | Existing customers, prospects | Master data, contact history, revenue data | CRM SaaS provider (USA) | USA – EU-US Data Privacy Framework (active listing on file, see DPF Annex) | 3 years after last contact | TOM Annex 1, 2, 5 |6869### Versioning footer7071```72Version 1.0 – Initial draft – [date, author]73Version 1.1 – [change] – [date, author]74```7576## Common mistakes7778- Mixing "purpose" and "legal basis" in one column.79- Listing individual recipients ("Ms. Smith, accountant") instead of categories ("Tax advisory firms").80- Stating "USA" without naming the transfer tool.81- Generic retention "10 years" without differentiation by data category.82- Copying the full Art. 32 wording into the TOM column instead of referring to a TOM annex.83- Failing to list a DPO where one is mandatory under Sec. 38 BDSG.8485## Cross-references8687- `ropa-art-30-dsgvo-grundlagen` for the German-language framework.88- `ropa-en-processor-template` for the processor counterpart.89- `ropa-konzernumlauf-und-multi-entity` for multi-entity groups.90- `dpa-en-template-controller-processor` for English DPA templates.91- `tia-en-template-full` for the English Transfer Impact Assessment template.9293## Sources as of 06/20269495- Regulation (EU) 2016/679 (GDPR), in particular Article 30(1), Recitals 13 and 82.96- BDSG (German Federal Data Protection Act), Sec. 26, 38.97- BRAO (Federal Lawyers' Act), Sec. 50.98- HGB Sec. 257; AO Sec. 147.99- DSK Short Paper No. 1 "Records of Processing Activities" (Status 17 December 2018).100- EDPB Position Paper on Article 30(5) GDPR (19 April 2018).
Klotzkette