Records of processing activities maintained per Art. 30

GDPR Art. 30 requires controllers to maintain written records of processing activities (ROPA) covering processing purposes, data categories, recipients, retention periods, and security measures. Though organizations under 250 employees are generally exempt unless processing is systematic, non-occasional, or involves special category data, the practical effect is that most SaaS products should maintain a ROPA — and those that cannot demonstrate the exemption on request are treated as non-exempt. In a breach or regulatory investigation, the ROPA is the first document a DPA requests. Absence of any data register also makes it impossible to correctly scope DSARs, breach notifications, or deletion requests.

Create a ROPA in docs/ROPA.md or as a spreadsheet linked from the README. Cover every processing activity with all Art. 30(1) required fields.

# Records of Processing Activities — Art. 30 GDPR
Controller: Example Corp | privacy@example.com | Last updated: 2026-02-22

| Processing Activity   | Purpose              | Data Categories          | Recipients     | Retention     | Legal Basis     |
|-----------------------|----------------------|--------------------------|----------------|---------------|-----------------|
| User account mgmt     | Service delivery     | Email, name, hash(pwd)   | Clerk (auth)   | Until deletion| Contract        |
| Transactional email   | Notifications        | Email, name              | Resend         | 90 days       | Contract        |
| Usage analytics       | Product improvement  | Pseudonymous ID, events  | Internal only  | 26 months     | Legitimate int. |
| Payment processing    | Order fulfillment    | Billing address          | Stripe         | 7 years*      | Contract/Legal  |
| Error monitoring      | Service reliability  | Error context, user ID   | Sentry         | 90 days       | Legitimate int. |

*Financial records retained 7 years under legal obligation (Art. 6(1)(c)).

Update the ROPA within 30 days of adding or changing any processing activity. Reference it from your DPA registry and breach notification procedure.