F-Q99 - Record of Processing Form
| File Reference : | F-Q99 - Record of Processing Form |
Article 30 of the UK GDPR expects most organisations to keep a record of what personal data they process and why. This form documents each processing activity, its lawful basis, any sharing or transfer, and how the data is stored and protected - the backbone record the ICO and an auditor will ask to see.
This form template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Form number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested form templates. No junk, jargon or unnecessary fields. Simple and usable form templates
developed over 25 years through practical use in the real world. No AI generated nonsense here!
Further guidance on records of processing and data protection:
Download this form template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This form is also included in the GDPR & Data Protection Toolkit and every alphaZ ISO toolkit that covers information security and data protection, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help documenting your processing activities and RoPA, or your wider information security management system, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Record of Processing Form Template
A record of processing activities (RoPA) form for documenting the personal data your organisation processes. It captures each processing activity, the categories of data, the purpose and lawful basis, any sharing or transfer, and where the data is held and how it is protected.
Article 30 of the UK GDPR requires controllers and processors to maintain a record of processing activities. This form gives you a practical way to build and maintain that record, and to demonstrate accountability under the Data Protection Act 2018.
Built for the UK GDPR Article 30 Record
The form captures what a record of processing needs:
- The processing activity, the data controller and, where appointed, the data protection officer
- A description of the personal data and the processing operation and its purpose
- The lawful basis for processing and any sharing or transfer of the data
- Where the data is stored and held and the protection applied, including special-category flags
What's Included in this Record of Processing Form
The form is set out so a processing activity can be described in full and reviewed over time:
- Processing activity header - the activity, completed by, data controller, data protection officer, and date created and reviewed
- Description of the data and activity - what the personal data is and what the processing operation does
- Purpose and lawful basis - why the data is processed and the lawful basis relied on
- Sharing and transfer - details of any transfer or sharing of the data with third parties
- Data protection and security - where the data is stored and held and the protection applied to it
Who Needs a Record of Processing Form?
Any organisation that processes personal data as more than an occasional activity is expected to keep a record of processing. It suits smaller businesses that need a clear, maintainable record without a dedicated data protection team, and anyone maintaining data protection compliance or an information security management system aligned with ISO 27001.
Included in the GDPR & Data Protection Toolkit
This form is part of the GDPR & Data Protection Toolkit - the registers, forms, policies and guidance for documenting how you collect and process personal data in one download - and is included in the alphaZ ISO 27001 Toolkit for information security.
Pairs with the Data Protection Impact Assessment
Where a processing activity you record looks high risk, the F-Q97 Data Protection Impact Assessment takes it further, assessing the risk to individuals and the controls needed before the processing goes ahead.