Skip to main content
Glossary termPublished inNormenkader IBP

Record of processing activities

Also known as register van de verwerkingsactiviteiten, verwerkingsregister, ROPA

What must a record of processing activities contain under the GDPR?

  • 1. Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:
    • (a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;
    • (b) the purposes of the processing;
    • (c) a description of the categories of data subjects and of the categories of personal data;
    • (d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;
    • (e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;
    • (f) where possible, the envisaged time limits for erasure of the different categories of data;
    • (g) where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

Defined in / by

Last updated: 14 October 2026.

The register every other duty leans on

The record is where a controller writes down what it processes. Most of the seven items in Article 30(1) feed another obligation: the purposes in point (b) must match the purposes given to data subjects under Articles 13 and 14, the recipients in point (d) are those the information notice names, and the retention periods in point (f) are the ones a controller must be able to justify under the storage limitation principle in Article 5(1)(e).

Processors keep a record too. Article 30(2) gives them a shorter list: the processor's and each controller's details, the categories of processing carried out for each controller, transfers, and a description of security measures. Article 30(3) requires both records in writing, including electronic form, and Article 30(4) requires them to be made available to the supervisory authority on request.

Article 30(5) exempts organisations with fewer than 250 employees, but only where the processing is unlikely to result in a risk to data subjects, is occasional, and does not include special categories of data or data on criminal convictions. A school board processes pupil data every day, so the exemption will rarely help it. The Dutch name, register van de verwerkingsactiviteiten, is the one Kennisnet's begrippenlijst for the Normenkader IBP uses.

Questions and answers

Does a small school board need a record of processing activities under the GDPR?

Usually yes. Article 30(5) of the GDPR exempts organisations with fewer than 250 employees only where the processing is unlikely to result in a risk, is occasional and excludes special categories of data and criminal data. Regular processing of pupil data does not meet the condition of being occasional.

Must a processor keep its own record of processing activities under the GDPR?

Yes. Article 30(2) of the GDPR requires each processor to keep a record of all categories of processing activities carried out on behalf of a controller, with the contents that paragraph lists.

Regulations

  • Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

    The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

    Next
    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms