---
title: "Record of processing activities"
description: "Record of processing activities under GDPR Article 30(1): the register each controller keeps, and the seven items, (a) to (g), it must contain."
canonical: "https://gencompl.ai/glossary/record-of-processing-activities-gdpr"
language: "en-US"
type: "Glossary term"
published: "2026-10-14T18:24:38.934Z"
modified: "2026-10-14T19:19:44.213Z"
---

# Record of processing activities

Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility.

Also known as: register van de verwerkingsactiviteiten, verwerkingsregister, ROPA

**What must a record of processing activities contain under the GDPR?**

Defined in: [Normenkader IBP](https://gencompl.ai/regulations/normenkader-ibp)

[Home](https://gencompl.ai/) › [Glossary](https://gencompl.ai/glossary) › Record of processing activities

- **1.** Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:
    - (a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;
    - (b) the purposes of the processing;
    - (c) a description of the categories of data subjects and of the categories of personal data;
    - (d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;
    - (e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;
    - (f) where possible, the envisaged time limits for erasure of the different categories of data;
    - (g) where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

## Defined in / by

- [GDPR (32016R0679)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Article 30(1)

Last updated: 14 October 2026.

## The register every other duty leans on

The record is where a controller writes down what it processes. Most of the seven items in Article 30(1) feed another obligation: the purposes in point (b) must match the purposes given to data subjects under Articles 13 and 14, the recipients in point (d) are those the information notice names, and the retention periods in point (f) are the ones a controller must be able to justify under the storage limitation principle in Article 5(1)(e).

Processors keep a record too. Article 30(2) gives them a shorter list: the processor's and each controller's details, the categories of processing carried out for each controller, transfers, and a description of security measures. Article 30(3) requires both records in writing, including electronic form, and Article 30(4) requires them to be made available to the supervisory authority on request.

Article 30(5) exempts organisations with fewer than 250 employees, but only where the processing is unlikely to result in a risk to data subjects, is occasional, and does not include special categories of data or data on criminal convictions. A school board processes pupil data every day, so the exemption will rarely help it. The Dutch name, *register van de verwerkingsactiviteiten*, is the one Kennisnet's begrippenlijst for the Normenkader IBP uses.

> **What we could not establish**
>
> This entry fixes the term as the GDPR words it. It does not decide whether a given processing at your school or organisation meets the Regulation; that is a question for your data protection officer or counsel.

## Questions and answers

### Does a small school board need a record of processing activities under the GDPR?

Usually yes. Article 30(5) of the GDPR exempts organisations with fewer than 250 employees only where the processing is unlikely to result in a risk, is occasional and excludes special categories of data and criminal data. Regular processing of pupil data does not meet the condition of being occasional.

### Must a processor keep its own record of processing activities under the GDPR?

Yes. Article 30(2) of the GDPR requires each processor to keep a record of all categories of processing activities carried out on behalf of a controller, with the contents that paragraph lists.

## Sources

- [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) (EUR-Lex · 4 May 2016)
- [Normenkader IBP: begrippenlijst](https://normenkaderibp.kennisnet.nl/begrippenlijst/) (Kennisnet)

## Related content

### Regulation

- [Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)](https://gencompl.ai/regulations/normenkader-ibp): The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.