Data inventory and ROPA template
Write each processing activity once, on a sheet laid out as the items of GDPR Article 30, and get three documents from it: the record of processing activities (ROPA) by purpose, the data inventory by system, and the California list of personal information categories in the CCPA’s own terms. It starts from a worked example, flags every empty item, and runs entirely in your browser.
Build the map
Pre-filled with a realistic example: a 30-person online language school in Dublin that teaches adults in the EU and California over live video, runs ads on its free practice site and hosts a portal for one employer client. Pick a card to edit its sheet; Reset clears everything for your own.
Processing activities
One card per purpose. The letters are the Art. 30 items each line must carry: black is filled, tinted is still open.
Sheet PA-03
(b): Purposes of the processing, Art. 30(1)(b)
(c): Categories of data subjects and of personal data, Art. 30(1)(c)
(d): Categories of recipients, Art. 30(1)(d)
(e): Transfers to a third country, Art. 30(1)(e)
(f): Time limits for erasure, where possible, Art. 30(1)(f)
Check: Set a time limit for erasure, or the criteria
(g): Security measures, where possible, in general terms, Art. 30(1)(g)
sys: Systems and vendors (the inventory side)
CA: California categories, Civ. Code § 1798.140(v)(1)
Lines ready for the record
6 of 7
Still open: Placement tests and progress reports.
The fewer-than-250-persons exemption (Art. 30(5)) does not lift this record: 7 lines are routine, not occasional, and Payroll and staff records includes special-category data.
6 lines as controller, 1 line for clients, 4 transfers outside the EU/EEA
Art. 30 record: Example Language School Ltd
- (a) Controller
- Example Language School Ltd
- Contact
- Dublin, Ireland; privacy@example.com
- Representative
- Not needed: the school is established in the EU
- Data protection officer
- None appointed; the Art. 37 test is filed with this record
- Last reviewed
- 2026-10-01
| Activityone per purpose | Purpose(b) | People and data(c) | Recipients(d) | Transfers(e) | Erasure(f) | Security(g) |
|---|---|---|---|---|---|---|
| Learner accounts and enrolment | Enrol adult learners, run their course accounts and take payment for courses | Learners; the person paying, when an employer booksName, email, country, course bookings, attendance, payment status (card numbers stay with the payment processor) | Learning platform host and payment processor (both processors); the school's bank | United States: SCCs, Art. 46(2)(c) | Account deleted 3 years after the learner's last course (the school's own choice); invoices kept for the period tax law sets | Single sign-on with two-step login; teachers see only their own classes; encrypted in transit and at rest |
| Live video lessons and recordings | Teach live lessons and let learners replay a recorded lesson for 30 days | Learners; teachersVideo, audio and chat of each lesson; who attended | Video-call provider (processor) | United States: DPF adequacy, Art. 45. Provider's entry on the Data Privacy Framework List checked and filed with its processor agreement | Recordings deleted 30 days after the lesson (the school's own choice) | Recordings visible to the class only; links expire; teacher accounts use two-step login |
| Placement tests and progress reports | Place each learner at the right level and report progress to the learner and, for employer-paid courses, to the employer | LearnersTest answers, level scores, teachers' comments | Employers that pay for a learner's course (the progress report only) | None | not set | Same access rules as the learning platform; reports sent through the platform, not by email |
| Newsletter and course offers | Email course news and offers to people who signed up for them | Subscribers; past learners who opted inName, email, languages of interest, opens and clicks | Email newsletter provider (processor) | United States: SCCs, Art. 46(2)(c) | Removed on unsubscribe; the address stays on a suppression list so it is never emailed again | Two named staff hold the account; two-step login |
| Website analytics and ad retargeting | Count visits to the free practice site and show course ads on other sites to people who visited it | Website visitorsCookie and device identifiers, IP address, pages viewed, ad clicks | Analytics provider (processor); ad platform (a separate controller) | United States: DPF adequacy, Art. 45. Both providers' entries on the Data Privacy Framework List checked; dated copies filed | Analytics events deleted after 14 months and ad audiences after 180 days (the school's own settings) | Both tags blocked until a visitor accepts the banner; IP truncation switched on |
| Payroll and staff records | Pay staff, run sick leave and meet the employer's tax and social-insurance duties | EmployeesContact details, bank account, salary, tax number, sick-leave certificates (health data)special category | Payroll provider (processor); the tax authority; the pension provider | None | The periods Irish tax and employment law set, then deleted | Two named managers only; HR folder encrypted and access logged |
GDPR Art. 30(1)(b)–(g); (a) heads the record, read 22 Oct 2026. | ||||||
| Work for a clientone per client | Controller(a) | Processing carried out(b) | Transfers(c) | Security(d) |
|---|---|---|---|---|
| Branded learning portal for a client employer | A logistics company in Rotterdam (it decides who enrols and which reports it gets) | Host the client's staff accounts and course records on its instructions; send it monthly attendance reports | None | As set in the client's processor agreement: two-step login, encryption, access for named account managers only |
GDPR Art. 30(2)(a)–(d), read 22 Oct 2026. | ||||
What the rules ask of a record
- Who keeps one
- every controller, Art. 30(1); every processor its own, Art. 30(2)
- Form and audience
- in writing, electronic form included; shown to the supervisory authority on request, Art. 30(3)–(4)
- Small-firm exemption
- fewer than 250 persons, unless the processing is risky, not occasional, or covers Art. 9(1) or Art. 10 data, Art. 30(5)
- Transfer safeguards
- adequacy, Art. 45; safeguards such as SCCs, Art. 46(2)(c); derogations, Art. 49(1)
- California categories
- (A) to (L), Civ. Code § 1798.140(v)(1); sensitive: § 1798.140(ae)
- California privacy policy
- categories collected in the preceding 12 months, in the statute's terms, regs § 7011(e)(1)(A)
Rule texts read 22 Oct 2026.
What it works out
A data inventory and a record of processing activities (ROPA) are the same facts filed two ways. You write each processing activity once, on a sheet laid out as the letters of GDPR Article 30, and the builder turns those lines three ways: the Art. 30 record, grouped by purpose; the inventory, grouped by system; and the California list, grouped by the categories the CCPA names. Each card shows which letters are still empty, and the result counts the lines ready to file.
It also reads two things the law cares about from your own answers. A line marked routine or holding special-category data keeps the record duty alive for a small firm, so the result says when the Art. 30(5) exemption cannot help. A transfer outside the EU/EEA with no safeguard named is flagged on its card. If the difference between a map and a record is new to you, the data mapping guide explains it before you start.
It does not decide your purposes, periods or safeguards, and it does not tell you that a record is complete in a regulator’s eyes. Nothing you type leaves this tab: it is not sent to us or stored, and closing the tab clears it. Download CSV saves a file to your own device. Information, not legal advice.
Filling each letter so it holds up
Article 30(1) is short. Each of its seven items is a phrase, and most weak records fail on the same few words: a purpose that could cover anything, recipients called “third parties”, and erasure “as long as necessary”. The middle column is what a reviewer sees as a gap; the last is the kind of line that answers the question.
| Item | The rule's words | Reads as a gap | Holds up |
|---|---|---|---|
| (a) | the name and contact details of the controller | "Example Ltd" | Legal name, address and a privacy mailbox someone reads; the representative and DPO if you have them |
| (b) | the purposes of the processing | "Marketing" | "Email course offers to people who signed up for them": one purpose per line |
| (c) | a description of the categories of data subjects and of the categories of personal data | "Customer data" | "Learners: name, email, bookings, attendance" |
| (d) | the categories of recipients to whom the personal data have been or will be disclosed | "Third parties" | "Payment processor (processor); the bank" |
| (e) | transfers of personal data to a third country … including the identification of that third country | "Safeguards in place" | "United States: SCCs, Art. 46(2)(c); signed copy filed with the contract" |
| (f) | where possible, the envisaged time limits for erasure | "As long as necessary" | "Deleted 3 years after the last course", or the event that ends it |
| (g) | where possible, a general description of the technical and organisational security measures | "Industry-standard security" | "Two-step login; access by role; encrypted at rest" |
GDPR Art. 30(1), Official Journal text, read 22 Oct 2026. | |||
“The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form.”
Two letters hand off to other documents. The erasure limits in (f) should match your retention schedule line for line, and every processor named under (d) needs an Art. 28 contract, which the processor agreement template drafts. A line that holds special-category data at scale is also where a DPIA usually starts.
Worked example: one line, three outputs
The example school has 7 lines: 6 as controller and 1 done for a client. 4 send data outside the EU/EEA, and payroll carries sick-leave certificates, which are health data. Here is what its analytics and ad line becomes in each view.
| Output | What the line becomes |
|---|---|
| Art. 30 record | Purpose: Count visits to the free practice site and show course ads on other sites to people who visited it. Transfers: United States: DPF adequacy, Art. 45. Both providers' entries on the Data Privacy Framework List checked; dated copies filed. |
| Inventory | Listed under Ad platform pixel (US), Web analytics (US), Website (EU host): three systems to search when a visitor asks for their data. |
| California list | (A) Identifiers; (F) Internet or other electronic network activity information; (K) Inferences drawn to create a profile. Shared for cross-context advertising: yes. |
Invented firm; its periods are its own settings, read 22 Oct 2026. | |
That last “yes” matters most. A business that sells or shares personal information must post a “Do Not Sell or Share My Personal Information” link (Civ. Code § 1798.135(a)(1)) and must process opt-out preference signals; only a business that processes the signals frictionlessly may leave the link off (regs § 7025(e), (g)). An ad pixel is the usual way a small site starts sharing without noticing. The California list only matters once the CCPA reaches you, which the threshold calculator tests; if it does, the same list feeds your notice at collection.
Jurisdiction notes
EU: the GDPR
The record is the controller’s (Art. 30(1)) and, for work done on a client’s behalf, the processor’s own (Art. 30(2)); a non-EU firm’s EU representative keeps it too where that applies. It must be in writing, electronic form included, and shown to the supervisory authority on request. Breaching Art. 30 falls in the lower fine tier of Art. 83(4): up to EUR 10 000 000 or 2 % of worldwide annual turnover, whichever is higher. Notices, request replies and processor contracts are all checked against the record, so a stale one weakens every other answer.
California: the CCPA and its regulations
California has no Art. 30-style record, but its disclosures cannot be written without one. The privacy policy lists the categories collected in the preceding 12 months “using the specific terms” of § 1798.140(v)(1)(A)–(K) and (ae) (regs § 7011(e)(1)(A)), the categories sold or shared (D) and those disclosed to service providers (H). The notice at collection must say how long each category is kept, or the criteria (§ 1798.100(a)(3)). The California view of the builder is that list, in those words.
Virginia and the other state laws
The state laws modelled on Virginia’s ask for no record either, but they do ask for a documented data protection assessment of five kinds of processing: targeted advertising, selling personal data, risky profiling, sensitive data, and anything with a heightened risk of harm (Va. Code § 59.1-580(A)). A map is where those activities are found: the ad line and any sensitive-data line are the ones to assess.
Questions
Is a data inventory the same thing as a ROPA?
They hold the same facts. The inventory is usually organised by system, so you can find where a person’s data sits; the ROPA is the document Art. 30 asks for, organised by purpose. Keep one set of lines and show it both ways, which is what this template does.
We have fewer than 250 staff. Do we still need one?
Usually yes, at least in part. Art. 30(5) lifts the duty for an organisation employing fewer than 250 persons only when the processing is occasional, unlikely to be risky and holds no special-category or criminal-offence data, and any one of those three brings the duty back. The Article 29 Working Party (the EU authorities’ joint body before the EDPB) read it so that a small firm’s regular employee processing is not occasional and must be recorded; only the processing that qualifies can be left out.
Does the record have to state the lawful basis?
It is not one of the Art. 30(1) items. Your privacy notice must give the legal basis for each purpose (Art. 13(1)(c)), though, and writing it beside the purpose here saves doing the work twice. The builder keeps it as an optional field that appears in the CSV.
We process data for clients as well as for ourselves. Which record do we keep?
Both. Your own purposes go in the controller record; work done on a client’s instructions goes in a processor record listing each client, the processing, transfers and security (Art. 30(2)). Watch the line between them: a processor that starts deciding the purposes and means is treated as a controller for that processing (Art. 28(10)). Add client work with “Add work done for a client”.
How often should the map be updated?
Whenever a purpose, a vendor or a transfer changes, because the record has to describe processing as it is now. The GDPR asks for measures that are reviewed and updated where necessary (Art. 24(1)); California asks for the privacy policy to be updated at least once every 12 months (§ 1798.130(a)(5)), and that update starts from the map. Set the “Last reviewed” date each time.
When does a spreadsheet stop being enough?
When several people edit it, when systems change faster than anyone updates the sheet, or when requests arrive weekly and you need the systems view live. At that point, compare the data mapping software built for a first inventory. Until then, a CSV with an owner and a review date beats a tool nobody opens.