GDPR Processing Records Template: Free Article 30 Guide for SMEs
Maintaining records of processing activities is one of the most concrete and auditable obligations under the General Data Protection Regulation (Regulation 2016/679). Yet many small and medium-sized enterprises either skip it entirely or maintain records that are incomplete and unlikely to satisfy a supervisory authority inspection. This guide walks through Article 30 requirements, provides a free template structure, and shows a worked SME example.
Why Article 30 Records Matter
Article 30 sets record-keeping duties for controllers and processors, subject to the narrow paragraph 5 exemption for some processing by organizations with fewer than 250 employees. These records support accountability and help identify how personal data flows when responding to breaches or data subject requests.
The EDPB (European Data Protection Board) has consistently emphasized records of processing activities (ROPA) as a prerequisite for demonstrating the accountability principle under Article 5(2). In its 2021 Guidelines 01/2021 on Examples regarding Personal Data Breach Notification, the EDPB showed how incomplete data maps directly led to inadequate breach notifications. The ROPA is your data map.
Practically, supervisory authorities across EU member states have issued fines to organizations that could not produce up-to-date ROPA on request. The German DPA (DSK) and France's CNIL both include ROPA review in standard audits.
Who Is Exempt?
Article 30(5) provides an exemption for organizations with fewer than 250 employees — but only where the processing is occasional, is unlikely to risk rights and freedoms, and does not include special category or criminal-conviction data. In practice, this exemption is narrow. If you process employee data, customer data, or any health information, the exemption likely does not apply regardless of your headcount.
The EDPB and national DPAs have all recommended that SMEs maintain ROPA regardless of the exemption, as it is the foundation for virtually every other compliance obligation.
Mandatory Fields Under Article 30(1) — Controller
For controllers, Article 30(1) requires the following minimum fields:
Identity and contact
- Name and contact details of the controller
- Where applicable, the joint controller(s)
- The Data Protection Officer (DPO) contact if one has been designated
Processing activity details
- Purposes of the processing
- Description of the categories of data subjects
- Description of the categories of personal data
Recipients and transfers
- Categories of recipients to whom the personal data has been or will be disclosed
- Where applicable, transfers to third countries or international organizations, including documentation of appropriate safeguards (Standard Contractual Clauses, adequacy decisions)
Retention and security
- Where possible, the envisaged time limits for erasure of different categories of data
- Where possible, a general description of the technical and organizational security measures (Article 32)
Mandatory Fields Under Article 30(2) — Processor
If you act as a data processor on behalf of controllers, the requirements mirror Article 30(1) but focus on the processor's perspective: categories of processing, third country transfers, and security measures.
Free ROPA Template Structure
Below is a minimal template structure you can adapt for your organization. Each row in your ROPA represents one processing activity.
| Field | Example |
|---|---|
| Activity ID | ACT-001 |
| Activity Name | Customer newsletter management |
| Controller | Acme Ltd, 123 Example Street, London |
| DPO | [email protected] |
| Purposes | Direct marketing, relationship management |
| Legal Basis | Consent (Art. 6(1)(a)) |
| Data Subjects | Prospects, existing customers |
| Data Categories | Email, first name, last name, purchase history |
| Special Categories | None |
| Recipients | Internal marketing team; Mailchimp (processor) |
| Third-Country Transfers | Any actual restricted transfer and its verified mechanism |
| Retention Period | Set according to purpose and applicable rules |
| Security Measures | TLS in transit, AES-256 at rest, access logging |
| Last Updated | 2026-04-06 |
Worked SME Example: Online Retail (15 Employees)
Consider a small e-commerce company selling artisan goods across the EU with 15 employees and no formal DPO. Despite being below 250 employees, they process customer data continuously and must maintain ROPA.
Processing activity 1 — Order fulfillment
- Purpose: Fulfill purchase orders, manage returns
- Legal basis: Performance of a contract (Art. 6(1)(b))
- Data: Name, delivery address, email, phone, payment reference
- Recipients: Shipping partner (DHL), payment processor (Stripe)
- Transfers: Verify actual flows and applicable transfer mechanism
- Retention: Set by document type and applicable accounting obligation
Processing activity 2 — Website analytics
- Purpose: Improve user experience, measure performance
- Legal basis: Consent (Art. 6(1)(a)) via cookie banner
- Data: IP address (retention and anonymization to verify), page views, browser type
- Recipients: Analytics platform (Matomo, self-hosted)
- Transfers: None
- Retention: Set according to tool configuration, purpose and guidance
Processing activity 3 — Employee payroll
- Purpose: Salary administration, social contributions
- Legal basis: Legal obligation (Art. 6(1)(c))
- Data: Name, bank details, social security number, salary
- Recipients: Payroll software vendor (Silae), accountant
- Transfers: France only
- Retention: Set by document type and national labor rules
This small company already has three distinct activities with different legal bases, retention periods, and transfer implications. Each must be documented separately.
Keeping Records Up to Date
The ROPA is not a one-time exercise. It must reflect your current processing. Update records whenever processing changes; Article 30 sets no universal annual deadline.
A practical approach is to tie ROPA reviews to procurement and product development. Whenever a new SaaS tool is onboarded or a new product feature processes personal data, a ROPA entry should be created or updated before go-live.
How WarDek Supports Article 30 Compliance
WarDek provides technical observations for a scanned URL. It does not build or update Article 30 records, verify processor contracts or generate a legally complete ROPA.
Explore a WarDek technical scan as a complement to your manually maintained processing records.
Key Takeaways
Article 30 records are not optional for most SMEs despite the headcount exemption. A well-maintained ROPA gives you a data map that supports breach response, data subject rights requests, and supervisory authority audits. Start with one processing activity, document it fully, and build from there. The template structure above covers every mandatory field and adapts to any industry.
For related reading, see our guide on GDPR data processor obligations under Article 28.