# Standards and Regulatory References — RoPA Maintenance

## Primary Legislation

### GDPR Articles Supporting Ongoing Maintenance

- **Art. 5(2) — Accountability**: The controller shall be responsible for, and be able to demonstrate compliance with, the principles. This requires records to reflect current processing at all times, not just at the point of creation.
- **Art. 24(1) — Responsibility of the Controller**: The controller shall implement appropriate measures to ensure and demonstrate processing compliance. Stale or inaccurate records undermine this demonstration.
- **Art. 30(1)-(4)**: Records must be maintained (ongoing obligation, not one-time) and made available to the supervisory authority on request. Records that are outdated at the time of request fail to meet Art. 30(4).
- **Art. 25(1) — Data Protection by Design and by Default**: Requires the controller to implement measures at the time of determination of means and at the time of processing itself. Changes to processing means trigger RoPA updates.
- **Art. 35(11) — DPIA Review**: The controller shall carry out a review to assess if processing is performed in accordance with the DPIA, at least when there is a change in the risk. DPIA reviews often reveal RoPA update requirements.

## Regulatory Guidance

### EDPB and Supervisory Authority Positions

- **EDPB Position Paper on Art. 30 (2018)**: Emphasised that RoPA is a "living document" that must be kept up to date. Static, point-in-time records do not satisfy the accountability obligation.
- **CNIL (France) — Guide on RoPA Maintenance (2023)**: Recommends minimum annual review of all entries, with more frequent reviews for high-risk processing. Specifies that the RoPA should be updated before any new processing activity commences.
- **ICO (United Kingdom) — Accountability Framework**: The ICO's accountability framework assessment includes "How do you keep your records of processing activities up to date?" as a scored criterion. Organisations must demonstrate a systematic review process.
- **BfDI (Germany) — Art. 30 Guidance**: States that records must be updated "without undue delay" when processing changes, drawing a parallel to the Art. 33 breach notification timing standard.
- **DSB Austria — Annual Report 2022**: Noted that outdated RoPA was a common finding during investigations and recommended automated monitoring of record currency.

## Enforcement Precedents

- **Belgian DPA — Decision 21/2022**: Organisation sanctioned specifically for failure to maintain up-to-date processing records. Records had not been updated for over two years despite significant changes including new processing activities, changed processors, and organisational restructuring.
- **Romanian DPA (ANSPDCP) — Unicredit Bank (2019)**: Fine for incomplete RoPA. Investigation revealed that new processing activities had been introduced without corresponding RoPA entries, demonstrating failure of the maintenance process.
- **Polish DPA (UODO) — Decision ZSZZS.440.768.2018 (2019)**: Found that the controller's records did not reflect actual processing operations. The maintenance failure was cited as an aggravating factor in the penalty calculation.
- **Hamburg DPA — H&M (2020)**: The EUR 35.3 million fine investigation revealed that extensive employee surveillance processing was not recorded in the RoPA, indicating complete absence of a change management link between operational decisions and record maintenance.

## ISO/IEC Standards

- **ISO/IEC 27701:2019**: Section 7.2.8 requires regular review and update of processing records. Section 7.4 (PII de-identification and deletion) requires records to reflect current retention practices.
- **ISO/IEC 27001:2022**: Clause 7.5.3 (Control of documented information) establishes requirements for version control, approval workflows, and retention of previous versions — all directly applicable to RoPA document management.
- **ISO 31000:2018 — Risk Management**: Section 6.7 (Recording and reporting) requires that risk-related records be maintained in a current state, supporting the risk-based approach to RoPA review frequency.