ROPA Ireland: Record of Processing Activities Guide (2026)
Last updated 19 October 2026. General information only, not legal advice.
A record of processing activities, usually called a ROPA or RoPA, is one of the first documents the Data Protection Commission (DPC) can ask an Irish business to produce. It is also the foundation for almost everything else in GDPR compliance: privacy notices, retention schedules, data protection impact assessments and breach response all depend on knowing what personal data you hold and why. This guide explains who needs a ROPA, what Article 30 requires, and how to build one that stands up to scrutiny.
What is a ROPA and why does it matter?
Article 30 of the GDPR requires controllers, and processors acting on a controller’s behalf, to keep a written record of their processing. The record can be electronic. It must be made available to the supervisory authority on request, which in Ireland is the DPC.
The DPC describes the ROPA as one way of demonstrating the accountability principle in Article 5(2). A good record shows that you have thought about the purpose of each processing activity rather than collecting data “just in case”. It is also the document most people reach for first when handling a data subject request, a complaint or a breach.
Who has to keep a ROPA?
Article 30(5) exempts organisations employing fewer than 250 people, but the exemption is narrow. It does not apply where any one of the following is true:
- the processing is likely to result in a risk to the rights and freedoms of individuals (the DPC points out this is any risk, not only a high risk, and cites examples such as mortgage applications, use of artificial intelligence and location tracking);
- the processing is not occasional (the DPC’s example is HR or pay-related processing for employees); or
- the processing includes special-category data under Article 9 or criminal conviction and offence data under Article 10, such as biometric data, trade union membership or Garda vetting.
In practice, any business with employees and a payroll is processing personal data on a regular basis, so the exemption rarely helps. Sole traders and micro-businesses that employ staff, run a customer database or use CCTV should assume they need a record. If you are unsure whether your organisation is covered, our GDPR guide for small businesses explains the wider obligations.
Note that EU-level proposals to simplify record-keeping for smaller organisations have been under discussion. Until any change becomes law, Article 30 as it stands is what applies, so check the current position before relying on any exemption.
What must a controller’s ROPA contain?
Article 30(1) lists the minimum content. For each processing activity, the record should cover:
- the name and contact details of the controller, any joint controller and, where applicable, the Data Protection Officer (DPO);
- the purposes of the processing;
- the categories of data subjects and the categories of personal data;
- the categories of recipients, including recipients in third countries or international organisations;
- transfers to third countries and the safeguards relied on;
- the expected time limits for erasure, where possible; and
- a general description of the technical and organisational security measures, where possible.
The DPC also suggests useful extras: the Article 6 lawful basis, the Article 9 condition for special-category data, the transfer mechanism and a risk rating. If you add these, mark which fields are mandatory so the required content is not buried.
What about processors?
Processors have their own duty under Article 30(2). A payroll bureau, IT support provider or cloud service that handles data for clients must keep a record for each controller it works for, covering the controller’s details, the categories of processing carried out, relevant transfers and a general description of security measures. If you are a processor, start with each client and then break down the data you handle for that client.
How to build a ROPA, step by step
1. Map your data
Talk to each team: HR, finance, sales, marketing, operations and IT. Ask what personal data they collect, where it comes from, where it is stored and who it is shared with. Include departments that you think hold no personal data, so that nothing is missed.
2. Record each activity separately
Entries such as “employee data” are too broad. Split them into activities such as payroll, recruitment, CCTV, customer accounts and email marketing, each with its own purpose, data categories and retention period. The DPC warns against vague wording such as “personal data” or “appropriate security”.
3. Identify the lawful basis and special-category conditions
Even though Article 30 does not list the lawful basis as mandatory, recording it for each activity makes the exercise much more useful and ties it to your privacy notices. See our guide to GDPR consent in Ireland for when consent is, and is not, the right basis.
4. Capture processors, recipients and transfers
List every supplier that handles personal data on your behalf and any transfer outside the European Economic Area, together with the safeguard relied on. Do not use outdated transfer mechanisms.
5. Assign owners and review regularly
The DPC treats the ROPA as a shared responsibility, not just the DPO’s job. Name a process owner for each activity, and review the record on a schedule and whenever you launch a new product, supplier or system. Archive activities that have ended.
Common mistakes to avoid
- Relying on a blank template or sample. The DPC says these are not sufficient on their own.
- Treating a DPIA as a substitute. A data protection impact assessment is a different document for a different purpose.
- Linking to documents the DPC could not access, or using undefined acronyms, so the record is not self-explanatory.
- Letting it go stale after the initial exercise.
The DPC guidance notes that a small organisation can use a simple spreadsheet, and that you should be able to produce the actual record promptly when asked.
What happens if you do not have one?
The DPC says that failing to have ROPA documentation available could be considered non-compliance with the GDPR, and it may ask for the record during breach handling, complaints, inquiries and investigations. Article 30 is covered by the Article 83(4) tier of fines, with a maximum of €10 million or 2% of worldwide annual turnover, whichever is higher. Real fines depend on the circumstances. See our guide to GDPR fines in Ireland for how the DPC approaches penalties, and the guide on whether you need a Data Protection Officer if you are deciding who should own the record.
A ROPA is normally reviewed as part of a GDPR audit and gap analysis, which tests the record against what your business actually does. For the full picture, see our GDPR and data protection guides and services hub.
Need help with this? Plus Promotions Limited provides GDPR audit and gap analysis for Irish businesses, from €495. See the GDPR audit service.
Frequently asked questions
What is a ROPA under GDPR?
A ROPA (record of processing activities) is the written record of how your organisation uses personal data that Article 30 GDPR requires controllers and processors to keep. It lists purposes, data categories, recipients, transfers, retention and security measures.
Do small businesses need a record of processing activities in Ireland?
Often yes. The exemption for organisations with fewer than 250 employees does not apply if the processing is likely to risk individuals’ rights and freedoms, is not occasional, or includes special-category or criminal-offence data. Regular payroll and HR processing is not occasional, so most employers need a ROPA.
What must a ROPA include under Article 30 GDPR?
A controller’s record must include contact details, the purposes of processing, categories of data subjects and personal data, recipients, international transfers and safeguards, erasure time limits where possible, and a general description of security measures where possible.
Is a ROPA template enough to comply with Article 30?
No. The Data Protection Commission (DPC) has said that a blank template or sample is not sufficient. The record must describe your actual processing and be kept up to date.
What is the penalty for not keeping a ROPA?
Infringements of Article 30 fall under Article 83(4) GDPR, with maximum fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher. Actual fines depend on the facts of each case.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
