Mahope tools: EUComply Clean Copy DeskUptime Transmute BugBottle All tools
mahope.tools by mahoje.dk
FREE DOWNLOAD

RoPA Template — GDPR Article 30 Register

The record of processing activities that auditors ask for first — as a clean, copy-paste template. One page per processing activity. Free, no signup.

Download the RoPA template (.md)

Plain Markdown — paste into Notion, Google Docs, Word or your wiki.

Prefer to fill it in online? Try the free RoPA generator.

What's inside

The template gives you one repeatable block per processing activity with every field Article 30 expects:

  • Purpose and lawful basis (all six Art. 6 bases, plus a slot for your legitimate interests assessment)
  • Data subjects and data categories, including an Art. 9 special-categories check
  • Recipients and processors — so you know who needs an Art. 28 data processing agreement
  • Third-country transfers with the safeguard used (adequacy decision or SCCs)
  • Concrete retention periods and Art. 32 security measures
  • A short filing checklist to run before each entry goes into your register

How to use it

  1. List every distinct thing you do with personal data (newsletter, payroll, client analytics…).
  2. Copy the template block once per activity.
  3. Fill in each field — if a field is hard to fill, that is the finding: you probably lack a DPA, a retention rule or a documented basis.
  4. Keep all entries in one document and review it yearly.

The register records what you process. Nobody checks whether the site still agrees.

This template is free and complete — every field Article 30 expects, in plain Markdown you can paste into Notion, Google Docs or Word. Nothing is held back for a licence.

The gap is one step further out. Section 3 is where a register goes stale first, because recipients, processors and third-country transfers change without anyone updating the document. EUComply Pro opens the live URL and reports what the page actually loads: whether a privacy link exists in the footer at all, whether a tracker runs without a consent banner, whether a form posts over plain HTTP, and whether the response carries HSTS and a CSP header. Those are 18 server-side checks, and the free scanner already runs the 15 accessibility checks — 33 checks in all — and you get the report as a PDF to send to a client. $79/year per website.