GDPR Register: Do I Need One?

The short answer

Yes. If you process personal data of customers, staff, or suppliers, you need a GDPR register, also called Records of Processing Activities or RoPA. This is required by Article 30 of the GDPR, and the obligation kicks in the moment you have your first customer, supplier, or employee.

The “fewer than 250 employees” myth

Article 30(5) appears to exempt organisations with fewer than 250 employees. In practice, the exemption rarely applies because it has three carve-outs, and almost all businesses fall into at least one:

• The processing is more than occasional. Sending invoices to repeat customers, paying staff every month, storing supplier contacts, all of these are regular activities, not occasional ones.
• You process special categories of data. Health information, biometric data, data about minors, or anything covered by Article 9 disqualifies you.
• The processing could risk individual rights. Customer profiling, marketing automation, employee monitoring, and similar activities all fall in this bucket.

In reality, the exemption was designed for very narrow cases such as a one-off charity drive. If you operate a real business with regular customers and employees, assume the register applies to you.

What the register must contain

Per Article 30(1), the register must list every processing activity with:

• Who: whose data you process (customers, staff, suppliers, partners)
• What: the categories of personal data (name, email, address, payment info, etc.)
• Why: the purpose of the processing (invoicing, hiring, marketing, etc.)
• Legal basis: consent, contract, legal obligation, legitimate interest, etc.
• Recipients: which third parties receive the data, and whether they sit inside or outside the EU
• Retention: how long you keep each category
• Security: the technical and organisational measures in place

You should keep separate records for activities where you are the Data Controller (you decide why and how the data is processed) and where you are a Data Processor (you handle data on behalf of someone else).

What happens if you don’t have one

The supervisory authority can request your register during an inspection or after a complaint. If you can’t produce one, that itself is a GDPR breach. Penalties for missing or incomplete records have already been issued across the EU, including to SMEs. Beyond fines, the register is your own internal compass: without it, you can’t reliably answer data subject requests, manage breaches, or demonstrate accountability.

How to start

You have three options:

1. Build it yourself in a spreadsheet. Free, but high-maintenance and easy to leave incomplete.
2. Hire a consultant. Thorough, but expensive and dependent on their continued availability.
3. Use a tool like GDPRWise. The platform asks the right questions per business sector, generates the register from your answers, and keeps it current as your operations change.