GDPR Documentation Templates — ROPA, DPIA, Policies

What Documentation Does GDPR Require?

GDPR requires several documentation artifacts. For non-EU businesses, these need to cover all EU personal data processing activities. Below are templates for the most important documents, along with guidance on completing each.

Record of Processing Activities (ROPA) — Article 30

Your ROPA is the single most important GDPR document. It must be maintained in writing (electronic format is acceptable). For each processing activity, record: controller name and contact, processor name and contact (if applicable), EU Representative contact, purposes of processing, categories of data subjects, categories of personal data, categories of recipients, cross-border transfers (including transfer mechanism), retention periods, and security measures description. Download our DPA template for processor arrangements.

Data Protection Impact Assessment (DPIA) — Article 35

A DPIA is required for processing that is “likely to result in high risk to the rights and freedoms of natural persons.” This includes: systematic profiling, large-scale special category data processing, systematic monitoring of publicly accessible areas (CCTV), and processing of vulnerable persons’ data (children, employees). A DPIA template should include: systematic description of processing operations, necessity and proportionality assessment, risk assessment, and risk mitigation measures.

Privacy Policy

Your Privacy Policy must include: controller identity, EU Representative contact, purposes and legal bases for processing, categories of personal data processed, recipients of data, cross-border transfer details, retention criteria, data subject rights, and DPA contact information. Privacy Policy template →

Consent Records Register

For processing based on consent, maintain a register with: consent date and time, user identifier, consent text, method of collection, categories consented to, and withdrawal date (if applicable). Consent guide →

Data Breach Log (Article 33)

Record all breaches (reported and unreported): breach description, date and time of breach, date and time of discovery, categories and number of data subjects, categories and number of records, consequences, corrective actions, notification to DPA (yes/no), notification to data subjects (yes/no). Breach guide →

Get your EU Rep →