# Standards and Regulatory References

## Primary Legislation

### GDPR Article 30 — Records of Processing Activities

- **Art. 30(1)**: Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:
  - **(a)** the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;
  - **(b)** the purposes of the processing;
  - **(c)** a description of the categories of data subjects and of the categories of personal data;
  - **(d)** the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;
  - **(e)** where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;
  - **(f)** where possible, the envisaged time limits for erasure of the different categories of data;
  - **(g)** where possible, a general description of the technical and organisational security measures referred to in Article 32(1).
- **Art. 30(3)**: The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form.
- **Art. 30(4)**: The controller or the processor and, where applicable, the controller's or the processor's representative, shall make the record available to the supervisory authority on request.

### GDPR Article 5 — Principles Relating to Processing

- **Art. 5(1)(b)**: Purpose limitation — personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
- **Art. 5(1)(c)**: Data minimisation — personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
- **Art. 5(1)(e)**: Storage limitation — personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
- **Art. 5(2)**: Accountability — the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1.

### GDPR Article 24 — Responsibility of the Controller

- **Art. 24(1)**: Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.

### GDPR Article 32 — Security of Processing

- **Art. 32(1)**: Controllers and processors shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate: (a) pseudonymisation and encryption; (b) ongoing confidentiality, integrity, availability and resilience; (c) timely restoration capability; (d) regular testing and evaluation.

## Regulatory Guidance

### European Data Protection Board (EDPB)

- **EDPB Position Paper on Art. 30 (adopted 19 April 2018)**: Clarified that the Art. 30(5) exemption should be interpreted narrowly. Recommended that all organisations maintain RoPA as a matter of best practice regardless of employee count.
- **EDPB Guidelines 07/2020 on controller and processor concepts (adopted 7 July 2021)**: Provides detailed guidance on distinguishing controller and processor roles, which directly impacts whether Art. 30(1) or Art. 30(2) records are required.
- **EDPB Recommendations 01/2020 on supplementary measures (adopted 18 June 2021)**: Requires Transfer Impact Assessments for international transfers relying on SCCs, directly relevant to the Art. 30(1)(e) transfer field.

### National Supervisory Authority Templates

- **CNIL (France)**: Publishes a structured RoPA template in both PDF and machine-readable (CSV/JSON) format. The CNIL template adds recommended fields beyond Art. 30(1) minimums, including lawful basis and DPIA reference.
- **ICO (United Kingdom)**: Provides RoPA template aligned with UK GDPR Art. 30, with guidance notes for each field. Available on the ICO website under "Documentation" guidance.
- **BfDI (Germany)**: Publishes Hinweise zum Verzeichnis von Verarbeitungstaetigkeiten with sector-specific examples for public authorities and private organisations.
- **AEPD (Spain)**: Provides Facilita RGPD tool for small organisations to generate RoPA entries through a guided questionnaire.

## Enforcement Precedents

- **Romanian DPA (ANSPDCP) — Fine of EUR 15,000 against Unicredit Bank (2019)**: Incomplete RoPA with missing processing purposes and retention periods. Demonstrated that supervisory authorities actively inspect RoPA content quality, not just existence.
- **Belgian DPA — Decision 21/2022**: Organisation sanctioned for failure to maintain up-to-date processing records. Records had not been updated for over two years despite significant changes to processing activities.
- **Spanish AEPD — PS/00547/2021**: Fine imposed for absent processor records under Art. 30(2), confirming that processor record obligations are independently enforced and not derivative of the controller's compliance.
- **Hamburg DPA — Fine against H&M (EUR 35.3 million, 2020)**: While primarily an Art. 5/6 violation, the investigation was triggered by and revealed systematic failures in processing records documentation, underscoring RoPA as a supervisory entry point.

## ISO/IEC Standards

- **ISO/IEC 27701:2019** — Privacy Information Management System (PIMS): Section 7.2.8 requires maintaining records of processing. Section 8.2.6 requires processors to maintain records. Annex D maps to GDPR Art. 30 directly.
- **ISO/IEC 27001:2022** — Information Security Management System: Annex A Control 5.34 (Privacy and protection of PII) supports the security measures documentation required by Art. 30(1)(g).
- **ISO 31700-1:2023** — Privacy by Design for Consumer Goods and Services: Section 6.3 requires documenting processing activities as part of the privacy-by-design lifecycle.