Some organisations think about personal data by activity rather than by category, and need to show who is responsible for each one. This register records processing that way, with the impact assessment details alongside.
This register template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Register number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested register templates. No junk, jargon or unnecessary content. Simple and usable register templates
developed over 25 years through practical use in the real world.
Further guidance on records of processing:
Download this register template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This register is also included in the GDPR / Data Protection Toolkit, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help completing your record of processing activities and privacy notice, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Record of Processing Activities Register Template
A record of processing activities (RoPA) register organised by processing activity. For each activity it records the personal data and who it is about, the processing and purpose, AI use, sharing and transfers, where the data is held and protected, retention, who is responsible, the lawful basis and any special category condition, and the details of a data protection impact assessment where one was needed.
What's Included in this Register
- Description of the Personal Data and Category, who it is about, Processing Operation and Purpose, and AI Use
- Sharing / Transfer Details - including AI providers
- Where stored / held and Protection - security controls in place, and the retention schedule including AI copies
- Who is responsible - the owner of each processing activity
- Legal Basis / Condition - and data protection impact assessment details where required
Which Personal Data Register?
The GDPR / Data Protection Toolkit offers several ways to keep the same record, and only one needs to be kept up to date:
- F-IMS24 Personal Data Register - organised by category of personal data, one row per category. The simplest option and the usual starting point.
- F-IMS30 Record of Processing Activities Register - organised by processing activity, and also records who is responsible and whether an impact assessment was needed. Suits organisations with more processing activities or responsibility spread across several people.
- ER21 Personal Data Register - the same information in Excel for filtering and sorting, with linked sheets for transfers, requests, breaches and deletions. The suggested option where special category data is processed.
- F-Q99 Record of Processing Form - one form for a single processing activity described in full. Useful for a complex or higher risk activity alongside any of the registers.
- F-IMS201 Records Register - all the records the company keeps, not only personal data. Useful for finding where personal data sits among everything else.
If a single combined document is preferred, the P-26 Privacy Policy can carry the record of processing as an appendix instead, with the same columns as F-IMS24.
Who Needs a Record of Processing Activities Register?
Organisations with a number of distinct processing activities, or where responsibility for personal data sits with several people, will find an activity-based record easier to keep current than one organised by data category.
Included in the GDPR / Data Protection Toolkit
This register is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download.
Works with the Data Protection Impact Assessment
Where an activity needs an impact assessment, carry it out on the F-Q97 Data Protection Impact Assessment and record the reference against the activity in this register.
Using the Register
List each processing activity - recruitment, payroll, customer orders, marketing, CCTV, AI tools used with personal data - and complete the row with the person responsible. Where an activity is high risk, note the impact assessment reference. Review the register when activities, suppliers or tools change.
Would you rather we prepared it for you?
Our Personal Data Register and Privacy Notice Preparation service works through the personal data your organisation holds with you, including the AI tools in use, and prepares the register and privacy notice so they describe what actually happens to that data.
Personal Data Register and Privacy Notice Preparation