# Data Processing Register Template (GDPR Article 30)

## Purpose

This template helps create a Record of Processing Activities (ROPA) as required by GDPR Article 30. Essential for GDPR compliance, demonstrating accountability, and enabling Data Protection Impact Assessments (DPIAs).

## When to Use

- **GDPR Article 30 compliance** (mandatory for most organizations)
- Data Protection Impact Assessments (DPIAs)
- Privacy audits
- Data mapping exercises
- Vendor/processor management
- Responding to data subject requests
- Breach notification preparation

## How to Use

1. **Identify Processing Activities**: List all ways personal data is processed
2. **Document Details**: Complete register for each activity
3. **Review Regularly**: Update quarterly or when changes occur
4. **Maintain Records**: Keep available for supervisory authorities
5. **Use for DPIAs**: Reference when assessing high-risk processing
6. **Data Subject Requests**: Use to locate and manage personal data

## Official References

- **GDPR**: Article 30 - Records of processing activities
- **GDPR**: Article 35 - Data protection impact assessment (related)
- **WP29 Guidelines**: Guidelines on transparency under Regulation 2016/679
- **EDPB**: Guidance on RoPA documentation

---

# RECORD OF PROCESSING ACTIVITIES (ROPA)

## Controller Information

**Organization Name**: _________________________________
**Registration Number**: _________________________________
**Address**: _________________________________
**Country**: _________________________________

**Data Protection Officer (DPO)**:
- Name: _________________________________
- Email: _________________________________
- Phone: _________________________________

**Date Register Created**: _________________________________
**Last Updated**: _________________________________
**Next Review**: _________________________________

---

## Processing Activity Register

### Activity Record 1

#### 1. Basic Information

| **Field** | **Details** |
|-----------|------------|
| **Activity ID** | PA-001 |
| **Activity Name** | Employee Recruitment and Onboarding |
| **Department/Owner** | Human Resources |
| **Description** | Collection and processing of candidate and employee data for recruitment, hiring, onboarding, and employment administration |
| **Date Processing Started** | 2020-01-01 |
| **Last Updated** | 2024-01-04 |

#### 2. Purposes of Processing

List all purposes for this processing activity:

- [ ] **Primary Purpose**: Recruitment and hiring
  - Screening candidates
  - Conducting interviews
  - Background verification
  - Employment decision-making

- [ ] **Secondary Purposes**:
  - Payroll administration
  - Benefits management
  - Performance management
  - Compliance with employment law

**Legal Basis** (select all applicable):
- [ ] **Consent** (GDPR Art. 6(1)(a)) - [Describe]
- [x] **Contract** (GDPR Art. 6(1)(b)) - Employment contract
- [x] **Legal Obligation** (GDPR Art. 6(1)(c)) - Tax and social security reporting
- [ ] **Vital Interests** (GDPR Art. 6(1)(d)) - [Describe]
- [ ] **Public Interest** (GDPR Art. 6(1)(e)) - [Describe]
- [x] **Legitimate Interests** (GDPR Art. 6(1)(f)) - Business operations, security

**Special Category Data Legal Basis** (if applicable):
- [ ] **Explicit Consent** (GDPR Art. 9(2)(a))
- [ ] **Employment Law** (GDPR Art. 9(2)(b))
- [ ] **Vital Interests** (GDPR Art. 9(2)(c))
- [ ] **Other** (specify): _______________

#### 3. Categories of Data Subjects

Who does this processing activity concern?

- [x] **Job Applicants**: Individuals applying for positions
- [x] **Employees**: Current staff members
- [x] **Former Employees**: Past staff (for references, alumni)
- [ ] **Contractors**: _________________________________
- [ ] **Dependents**: Family members (for benefits)
- [x] **References**: Contact persons providing recommendations

**Estimated Number**: 500-1000 applicants/year, 50-100 employees

#### 4. Categories of Personal Data

What types of personal data are processed?

**Basic Personal Data**:
- [x] Name, contact details (email, phone, address)
- [x] Date of birth, age
- [x] Gender
- [x] National ID number (for payroll, taxes)
- [x] Nationality, citizenship
- [x] Language preferences

**Employment Data**:
- [x] CV/Resume
- [x] Work history
- [x] Educational qualifications
- [x] Professional certificates/licenses
- [x] References and recommendations
- [x] Interview notes and assessments
- [x] Employment contract details
- [x] Job title, department, role
- [x] Salary and compensation
- [x] Performance evaluations
- [x] Training records

**Financial Data**:
- [x] Bank account details (for salary payment)
- [x] Tax information
- [x] Social security number
- [x] Pension information

**Special Category Data** (requires stronger legal basis):
- [ ] Racial or ethnic origin
- [x] Health data (sick leave, medical certificates)
- [ ] Biometric data (if using fingerprint/face recognition)
- [ ] Trade union membership
- [ ] Religious beliefs
- [ ] Sexual orientation
- [ ] Criminal convictions (background checks)

**Describe Special Category Data**:
Health data: Medical certificates for sick leave, occupational health assessments

#### 5. Sources of Personal Data

Where does the data come from?

- [x] **Directly from data subjects**: Application forms, interviews
- [x] **Third parties**: References, background check providers
- [ ] **Publicly accessible sources**: LinkedIn, professional databases
- [x] **Generated by organization**: Performance reviews, payroll systems
- [ ] **Other**: _________________________________

#### 6. Data Recipients

Who has access to or receives this personal data?

**Internal Recipients**:
- [x] HR Department
- [x] Line Managers (hiring managers)
- [x] Finance/Payroll Team
- [x] IT Department (system access)
- [ ] Legal/Compliance
- [ ] Other: _________________________________

**External Recipients**:
- [x] **Payroll Service Provider**: [Provider Name]
  - Purpose: Salary processing
  - Location: Estonia
  - Safeguards: DPA signed, GDPR compliant

- [x] **Background Check Provider**: [Provider Name]
  - Purpose: Employment verification
  - Location: EU
  - Safeguards: DPA, Standard Contractual Clauses

- [x] **Tax Authority**: Maksu- ja Tolliamet (Estonia)
  - Purpose: Tax reporting
  - Location: Estonia
  - Safeguards: Legal obligation

- [x] **Pension Provider**: [Provider Name]
  - Purpose: Pension contributions
  - Location: Estonia
  - Safeguards: DPA, legal obligation

- [ ] **Other**: _________________________________

#### 7. International Transfers

Is personal data transferred outside the EU/EEA?

- [ ] **No international transfers**
- [x] **Yes - transfers occur**

**If yes, provide details**:

| **Recipient** | **Country** | **Safeguards** | **Adequacy Decision** |
|---------------|-------------|----------------|----------------------|
| Cloud Provider (AWS) | USA | Standard Contractual Clauses (SCCs) | No (use SCCs) |
| Background Check Service | UK | UK GDPR adequacy decision | Yes |

**Transfer Mechanisms**:
- [ ] Adequacy decision (Art. 45)
- [x] Standard Contractual Clauses (Art. 46)
- [ ] Binding Corporate Rules (Art. 47)
- [ ] Other: _________________________________

#### 8. Retention Periods

How long is personal data kept?

| **Data Type** | **Retention Period** | **Legal Basis** |
|---------------|---------------------|-----------------|
| Applicant data (not hired) | 12 months | Consent, legitimate interest |
| Applicant data (withdrawn) | Deleted immediately | N/A |
| Employee data (current) | Duration of employment | Contract, legal obligation |
| Employee data (former) | 7 years after termination | Legal obligation (tax, labor law) |
| Payroll records | 7 years | Legal obligation (accounting law) |
| Performance reviews | 3 years after termination | Legitimate interest |

**Deletion Method**:
- Digital data: Secure deletion (overwrite)
- Physical documents: Shredding
- Backups: Flagged for deletion, purged per backup retention schedule

#### 9. Technical and Organizational Measures (Security)

What security measures protect this data?

**Technical Measures**:
- [x] Encryption in transit (TLS 1.3)
- [x] Encryption at rest (AES-256)
- [x] Access controls (role-based)
- [x] Multi-factor authentication (MFA)
- [x] Regular backups (daily)
- [x] Logging and monitoring
- [x] Antivirus/endpoint protection
- [x] Firewalls and network segmentation

**Organizational Measures**:
- [x] Access on need-to-know basis
- [x] Confidentiality agreements signed by staff
- [x] Data protection training (annually)
- [x] Incident response plan
- [x] Regular security audits
- [x] Vendor due diligence (DPAs)
- [x] Clear desk policy
- [x] Secure disposal procedures

**Risk Level**: ☐ Low  ☐ Medium  [x] High  ☐ Very High
(High due to special category health data and volume of employees)

#### 10. DPIA Required?

Is a Data Protection Impact Assessment required?

[x] **Yes - DPIA completed** (Date: _________)
[ ] **No - DPIA not required**

**Reasoning**:
Processing special category data (health), high volume, and automated decision-making (recruitment screening) require DPIA.

**DPIA Reference**: DPIA-HR-001 (stored separately)

#### 11. Data Subject Rights

How are data subject rights enabled?

- [x] **Right to Access (Art. 15)**: Via HR department, response within 30 days
- [x] **Right to Rectification (Art. 16)**: Employee can request corrections
- [x] **Right to Erasure (Art. 17)**: Upon withdrawal of application, subject to legal retention
- [x] **Right to Restriction (Art. 18)**: Flagged in HRIS system
- [x] **Right to Data Portability (Art. 20)**: Export in machine-readable format (CSV)
- [x] **Right to Object (Art. 21)**: Can object to processing for direct marketing or legitimate interests
- [x] **Rights related to automated decision-making (Art. 22)**: Applicants can request human review

**Contact for Rights Requests**: dpo@company.com

#### 12. Processors (Sub-processors)

List all data processors engaged:

| **Processor** | **Service** | **Location** | **DPA Signed** | **Sub-processors** |
|---------------|-------------|--------------|----------------|-------------------|
| [Payroll Provider] | Payroll processing | Estonia | Yes (2023-01-15) | None |
| [Background Check Co.] | Employment screening | EU | Yes (2022-06-01) | [List if any] |
| [Cloud Storage] | HR system hosting | EU/USA | Yes (2021-03-10) | AWS (SCCs) |

**Processor Management**:
- [ ] DPAs reviewed annually
- [ ] Security questionnaires completed
- [ ] Audit rights clause in contracts
- [ ] Sub-processor notification required

---

## Processing Activity Template (Blank)

Use this template for each additional processing activity:

### Activity Record [ID]

#### 1. Basic Information
- **Activity ID**: ___________
- **Activity Name**: ___________
- **Department/Owner**: ___________
- **Description**: ___________
- **Date Processing Started**: ___________

#### 2. Purposes of Processing
- **Primary Purpose**: ___________
- **Legal Basis**: ☐ Consent  ☐ Contract  ☐ Legal Obligation  ☐ Vital Interests  ☐ Public Interest  ☐ Legitimate Interests

#### 3. Categories of Data Subjects
- ___________
- Estimated Number: ___________

#### 4. Categories of Personal Data
- [ ] Basic identification (name, contact)
- [ ] Financial data
- [ ] Location data
- [ ] Online identifiers (IP, cookies)
- [ ] Special category data (describe): ___________

#### 5. Sources of Personal Data
- [ ] Directly from data subjects
- [ ] Third parties: ___________
- [ ] Publicly accessible sources
- [ ] Generated by organization

#### 6. Data Recipients
**Internal**: ___________
**External**: ___________

#### 7. International Transfers
- [ ] No  [ ] Yes
- If yes, describe safeguards: ___________

#### 8. Retention Periods
- Data Type: ___________ | Period: ___________ | Basis: ___________

#### 9. Technical and Organizational Measures
- Encryption: [ ] Yes  [ ] No
- Access controls: [ ] Yes  [ ] No
- Backups: [ ] Yes  [ ] No
- [Other measures]: ___________

#### 10. DPIA Required?
- [ ] Yes (reference: _____)  [ ] No

#### 11. Data Subject Rights
- Contact: ___________
- Process: ___________

#### 12. Processors
- Processor: ___________ | Location: ___________ | DPA: [ ] Yes  [ ] No

---

## Common Processing Activities (Examples)

### 1. Customer Relationship Management (CRM)
- **Purpose**: Customer acquisition, sales, support
- **Data**: Contact info, purchase history, communications
- **Legal Basis**: Contract, legitimate interests

### 2. Marketing and Communications
- **Purpose**: Newsletter, promotions, campaigns
- **Data**: Email, preferences, engagement data
- **Legal Basis**: Consent (for direct marketing)

### 3. Website Analytics
- **Purpose**: Website optimization, user experience
- **Data**: IP address, cookies, browsing behavior
- **Legal Basis**: Consent (cookies), legitimate interests

### 4. Financial Administration
- **Purpose**: Invoicing, payments, accounting
- **Data**: Billing details, transaction history
- **Legal Basis**: Contract, legal obligation (accounting law)

### 5. IT Security and Monitoring
- **Purpose**: Protect systems, detect threats
- **Data**: Login logs, network traffic, security events
- **Legal Basis**: Legitimate interests (security)

### 6. Vendor Management
- **Purpose**: Contract management, payments
- **Data**: Contact persons, company details, contracts
- **Legal Basis**: Contract, legitimate interests

---

## Data Mapping Diagram Template

```
[Data Source] → [Processing System] → [Storage] → [Recipients] → [Disposal]
    ↓               ↓                    ↓            ↓             ↓
 Where from?   What happens?        Where stored?  Who gets it?   When deleted?
```

**Example**:
```
Applicant      HRIS             AWS Cloud       Payroll         After
Job Portal  →  ATS System   →   (encrypted)  →  Provider   →    12 months
               Screening                        Tax Authority   (or 7y if hired)
```

---

## Compliance Checklist

- [ ] All processing activities documented
- [ ] Legal basis identified for each activity
- [ ] Data subjects and personal data categories listed
- [ ] Retention periods defined
- [ ] Security measures documented
- [ ] Processors identified with DPAs
- [ ] International transfers assessed (SCCs if needed)
- [ ] DPIAs completed where required
- [ ] Data subject rights procedures established
- [ ] Register reviewed and updated (quarterly)
- [ ] Register available for supervisory authority (AKI)

---

## DPIA Trigger Checklist

A DPIA is required when processing is likely to result in high risk. Triggers include:

- [ ] Systematic and extensive evaluation or scoring (automated decision-making)
- [ ] Large-scale processing of special category data
- [ ] Systematic monitoring of publicly accessible areas (CCTV)
- [ ] Innovative use of technology (AI, biometrics)
- [ ] Processing that prevents data subjects from exercising rights
- [ ] Matching or combining datasets
- [ ] Processing of vulnerable individuals (children, employees)
- [ ] Processing at large scale
- [ ] Cross-border transfers outside EU/EEA

**If 2 or more triggers apply → DPIA mandatory**

---

## Review and Update Schedule

| **Trigger** | **Action** | **Responsible** |
|-------------|------------|-----------------|
| **Quarterly** | Routine review of register | DPO |
| **New Processing Activity** | Add to register immediately | Data Owner + DPO |
| **Change to Existing Activity** | Update register within 30 days | Data Owner |
| **Data Breach** | Review affected processing activities | DPO + CISO |
| **Audit** | Full register review and validation | DPO + Legal |
| **Regulatory Changes** | Assess impact and update | DPO + Legal |

---

## Supervisory Authority Requests

If the supervisory authority (AKI in Estonia) requests the register:

1. **Respond within required timeframe** (typically 1 month, extendable to 3 months)
2. **Provide in accessible format** (Excel, PDF, or online access)
3. **Include all processing activities** (don't cherry-pick)
4. **Demonstrate ongoing maintenance** (show update history)
5. **Cooperate fully** (provide clarifications if requested)

**Contact**: Andmekaitse Inspektsioon (AKI)
- Website: https://www.aki.ee/en
- Email: info@aki.ee
- Phone: +372 627 4135

---

## Additional Resources

### GDPR References
- **Article 30**: Records of processing activities
- **Article 35**: Data protection impact assessment
- **Article 37**: Designation of the data protection officer
- **Recital 82**: DPIA guidance

### Templates and Tools
- European Commission SCC templates
- EDPB DPIA template
- National DPA guidance (AKI Estonia)

### Best Practices
- Link to privacy policy and notices
- Cross-reference with information security policies
- Maintain version control
- Regular staff training on GDPR and register updates

---

**Template Version**: 1.0
**Last Updated**: 2024-01-04
**Source**: InfoPol - Free InfoSec Resources

**Note**: This template provides a framework. Consult with legal counsel or a data protection expert for your specific requirements. GDPR compliance is context-dependent and this template may not cover all scenarios.