Record of processing activities

It is a map of processing, not a list of files

A record of processing activities, commonly called a ROPA, connects personal-data uses to their purposes, people, disclosures, transfers, retention and safeguards. It should let someone understand how a real process works without searching every policy and supplier contract.

For employment data, useful activities might include recruitment, payroll, absence management, performance, access control and leaver administration. Grouping by purpose is usually clearer than creating a row for every spreadsheet.

Small organisations should test the exemption carefully

Article 30 contains a limited exemption for organisations with fewer than 250 people. It does not apply to processing that is more than occasional, risks people's rights, or includes special category or criminal offence data. Routine employment administration is unlikely to be wholly occasional.

The ICO's documentation guidance also treats records as practical accountability evidence. A small employer may need a ROPA for legal reasons and can benefit from one even when a particular activity falls outside the strict duty.

Keep controller and processor facts distinct

A controller record should cover purposes, categories of people and data, recipients, international transfers, retention and a general description of security measures. A processor's record has different required fields, including each controller it acts for and the processing categories.

Use the record to check privacy notices, contracts, rights handling and deletion. If those documents disagree with the ROPA, investigate the underlying process instead of making the spreadsheet look consistent.