# Standards and Regulatory References

## Primary Legislation

### GDPR Article 30 — Records of Processing Activities
- **Art. 30(1)**: Obligation for controllers to maintain records containing: (a) identity and contact details of controller, joint controller, representative, and DPO; (b) purposes of processing; (c) categories of data subjects and personal data; (d) categories of recipients including third-country transfers; (e) international transfers with appropriate safeguards documentation; (f) envisaged time limits for erasure; (g) general description of technical and organisational security measures per Art. 32.
- **Art. 30(2)**: Obligation for processors to maintain records containing: (a) identity and contact details of processor(s), each controller, representative, and DPO; (b) categories of processing on behalf of each controller; (c) international transfers with safeguards; (d) general description of technical and organisational security measures.
- **Art. 30(3)**: Records must be in writing, including electronic form.
- **Art. 30(4)**: Records must be made available to the supervisory authority on request.
- **Art. 30(5)**: Limited exemption for organisations with fewer than 250 employees, subject to conditions.

### GDPR Article 5 — Principles Relating to Processing
- **Art. 5(1)(b)**: Purpose limitation — data collected for specified, explicit, and legitimate purposes. RoPA purpose fields must demonstrate compliance.
- **Art. 5(1)(e)**: Storage limitation — data kept no longer than necessary. RoPA retention fields must specify time limits or criteria.
- **Art. 5(2)**: Accountability — the controller must be able to demonstrate compliance with all principles. RoPA is a primary accountability document.

### GDPR Article 32 — Security of Processing
- **Art. 32(1)**: Controllers and processors must implement appropriate technical and organisational measures including: (a) pseudonymisation and encryption; (b) ongoing confidentiality, integrity, availability, and resilience; (c) timely restoration capability; (d) regular testing and evaluation.
- Referenced by Art. 30(1)(g) and Art. 30(2)(d) for the security measures field in RoPA.

### GDPR Article 24 — Responsibility of the Controller
- **Art. 24(1)**: Controller must implement appropriate technical and organisational measures to ensure and demonstrate processing compliance, taking into account nature, scope, context, purposes, and risks.
- **Art. 24(2)**: Where proportionate, measures shall include implementation of appropriate data protection policies.

## Regulatory Guidance

### EDPB Guidelines
- **EDPB Position Paper on Art. 30 (adopted 19 April 2018)**: Clarified that the Art. 30(5) exemption is narrow and should not be interpreted broadly. Recommended all organisations maintain RoPA regardless of size.
- **EDPB Guidelines 07/2020 on controller and processor concepts**: Clarified the distinction between controller and processor record obligations and when joint controller records under Art. 26 must be cross-referenced.

### National Supervisory Authority Guidance
- **CNIL (France) — RoPA Template and Guide (2024)**: Provides standardised RoPA template with mandatory and recommended fields, available in machine-readable format.
- **ICO (UK) — Documentation and Records Guidance**: Specifies that records should be proportionate but comprehensive, and that the ICO may request records during investigations or audits under s.142 Data Protection Act 2018 (which mirrors Art. 30(4) GDPR).
- **BfDI (Germany) — Guidance on Art. 30 Records**: Emphasises that records must be kept current and that the description of technical measures under Art. 30(1)(g) must reflect actual implemented measures, not planned measures.

## Enforcement Precedents

- **Romanian DPA (ANSPDCP) — Fine of EUR 15,000 against Unicredit Bank (2019)**: Incomplete RoPA missing processing purposes and retention periods.
- **Belgian DPA — Decision 21/2022**: Organisation fined for failure to maintain up-to-date processing records as required by Art. 30.
- **Spanish AEPD — PS/00547/2021**: Sanction for absent processor records under Art. 30(2), demonstrating that processor obligations are independently enforced.

## ISO/IEC Standards

- **ISO/IEC 27701:2019** — Privacy Information Management System (PIMS): Section 7.2.8 requires documented records of processing activities, aligned with GDPR Art. 30.
- **ISO/IEC 27001:2022** — Information Security Management System: Annex A Control 5.34 (Privacy and protection of PII) supports the security measures documentation required by Art. 30(1)(g).