Processor Ropa Creation

Processor RoPA Creation

Overview

GDPR Article 30(2) imposes an independent obligation on every processor to maintain a record of all categories of processing activities carried out on behalf of each controller. Unlike controller records under Art. 30(1), processor records are scoped to the processing performed under the controller's instructions and contain four mandatory fields. This skill provides the complete methodology for creating and maintaining processor RoPA entries that satisfy Art. 30(2)(a) through (d).

The processor obligation is independently enforced. The Spanish AEPD sanctioned a processor under PS/00547/2021 for failure to maintain Art. 30(2) records, confirming that compliance is not derivative of the controller's own record-keeping.

Mandatory Field Requirements — Art. 30(2)

Field 1: Processor and Controller Identity — Art. 30(2)(a)

This field must identify:

• Processor legal entity name: Registered name as it appears in the national business register.
• Processor contact details: General contact email and telephone for data protection matters.
• Each controller on whose behalf the processor acts: Legal entity name and contact details of every controller whose data the processor processes.
• Controller's representative (if applicable): Where the controller is established outside the EEA and has appointed an Art. 27 representative.
• DPO: Contact details of the DPO of both the processor and each controller (if appointed).

Example for Helix Biotech Solutions acting as a processor:

Helix Biotech Solutions GmbH provides laboratory information management system (LIMS) hosting services to external pharmaceutical companies.

Field 2: Categories of Processing — Art. 30(2)(b)

Document the categories of processing carried out on behalf of each controller. This must describe what the processor actually does with the data, not the controller's broader processing purposes.

Processing categories must be documented per controller:

Key distinctions:

• Processor records describe what the processor does (hosting, storing, transmitting, deleting), not why the controller collects the data.
• Each controller must have separately documented processing categories, even if the categories are identical in practice.
• Time-limited processing (such as migration projects) should include start and end dates.

Field 3: International Transfers — Art. 30(2)(c)

Record every transfer of personal data to a third country or international organisation that occurs as part of the processor's activities. This includes:

• Transfers by the processor itself (e.g., using sub-processors in third countries)
• Transfers resulting from remote access by support staff in third countries
• Transfers to the controller if the controller is in a third country

Example:

Sub-processor transfers: When the processor engages sub-processors in third countries, the processor must document these transfers in its Art. 30(2) record even though the controller's Art. 28 authorisation and Art. 30(1)(e) record should also reflect them.

Field 4: Security Measures — Art. 30(2)(d)

Provide a general description of the technical and organisational security measures implemented by the processor under Art. 32(1). This description should reflect the measures the processor actually applies to protect the controller's data.

Example security measures description:

Technical measures: Multi-tenant cloud infrastructure with logical tenant isolation using dedicated database schemas per controller. AES-256 encryption at rest (AWS KMS managed keys, per-controller keys). TLS 1.3 for all data in transit. Network segmentation with dedicated VPCs per tenant. Role-based access control with quarterly access reviews. Multi-factor authentication for all administrative and data access. Immutable audit logging with 2-year retention (AWS CloudTrail). Daily automated backups with cross-region replication and quarterly restore testing. Vulnerability scanning (weekly) and penetration testing (annually by NCC Group). Endpoint detection and response on all employee workstations.

Organisational measures: ISO 27001:2022 certified (certificate ref: IS 891245, scope includes LIMS hosting services). SOC 2 Type II audit completed annually (latest report: 2025-Q3). All staff with data access have completed background checks, signed confidentiality agreements, and undergo annual data protection training. Incident response procedure with 24-hour initial assessment and controller notification per Art. 33(2). Sub-processor management programme with security assessments prior to engagement and annual re-assessment. Data processing restricted to documented controller instructions per Art. 28(3)(a).