Overview
GDPR Article 30(2) imposes an independent obligation on every processor to maintain a record of all categories of processing activities carried out on behalf of each controller. Unlike controller records under Art. 30(1), processor records are scoped to the processing performed under the controller's instructions and contain four mandatory fields. This skill provides the complete methodology for creating and maintaining processor RoPA entries that satisfy Art. 30(2)(a) through (d).
The processor obligation is independently enforced. The Spanish AEPD sanctioned a processor under PS/00547/2021 for failure to maintain Art. 30(2) records, confirming that compliance is not derivative of the controller's own record-keeping.
Mandatory Field Requirements — Art. 30(2)
Field 1: Processor and Controller Identity — Art. 30(2)(a)
This field must identify:
- Processor legal entity name: Registered name as it appears in the national business register.
- Processor contact details: General contact email and telephone for data protection matters.
- Each controller on whose behalf the processor acts: Legal entity name and contact details of every controller whose data the processor processes.
- Controller's representative (if applicable): Where the controller is established outside the EEA and has appointed an Art. 27 representative.
- DPO: Contact details of the DPO of both the processor and each controller (if appointed).
Example for Helix Biotech Solutions acting as a processor:
Helix Biotech Solutions GmbH provides laboratory information management system (LIMS) hosting services to external pharmaceutical companies.
| Sub-field | Value |
|---|---|
| Processor legal entity | Helix Biotech Solutions GmbH |
| Processor registered address | Leopoldstrasse 42, 80802 Munich, Germany |
| Processor registration | HRB 267891, Amtsgericht Munich |
| Processor contact email | processor-privacy@helix-biotech.eu |
| Processor DPO | Dr. Elena Voss, dpo@helix-biotech.eu |
| Controller 1 | Meridian Pharma AG, Bahnhofstrasse 15, 8001 Zurich, Switzerland |
| Controller 1 DPO | Thomas Keller, dpo@meridian-pharma.ch |
| Controller 1 EU representative | Meridian Pharma EU Representative Ltd, Dublin, Ireland (Art. 27 representative for non-EEA controller) |
| Controller 2 | NovaCure Therapeutics S.A., Avenue Louise 54, 1050 Brussels, Belgium |
| Controller 2 DPO | Marie Dupont, dpo@novacure.eu |
| Art. 28 DPA reference (Controller 1) | DPA-2024-MER-001, executed 2024-05-15 |
| Art. 28 DPA reference (Controller 2) | DPA-2024-NOV-002, executed 2024-08-22 |
Field 2: Categories of Processing — Art. 30(2)(b)
Document the categories of processing carried out on behalf of each controller. This must describe what the processor actually does with the data, not the controller's broader processing purposes.
Processing categories must be documented per controller:
| Controller | Processing Categories | Description |
|---|---|---|
| Meridian Pharma AG | LIMS data hosting and management | Hosting of laboratory test results, sample tracking data, and quality control records on Helix cloud infrastructure. Includes database management, backup, disaster recovery, and system administration. |
| Meridian Pharma AG | Technical support | Troubleshooting and resolving LIMS system issues requiring access to data records. Access logged and time-limited. |
| NovaCure Therapeutics S.A. | LIMS data hosting and management | Hosting of pre-clinical and Phase I clinical laboratory data on dedicated Helix cloud tenant. Includes database management, backup, and disaster recovery. |
| NovaCure Therapeutics S.A. | Data migration | One-time migration of legacy laboratory data from NovaCure on-premises systems to Helix cloud platform. Completed 2024-10-15, data access revoked post-migration. |
Key distinctions:
- Processor records describe what the processor does (hosting, storing, transmitting, deleting), not why the controller collects the data.
- Each controller must have separately documented processing categories, even if the categories are identical in practice.
- Time-limited processing (such as migration projects) should include start and end dates.
Field 3: International Transfers — Art. 30(2)(c)
Record every transfer of personal data to a third country or international organisation that occurs as part of the processor's activities. This includes:
- Transfers by the processor itself (e.g., using sub-processors in third countries)
- Transfers resulting from remote access by support staff in third countries
- Transfers to the controller if the controller is in a third country
Example:
| Controller | Destination | Recipient | Data | Safeguard | TIA Ref |
|---|---|---|---|---|---|
| Meridian Pharma AG | Switzerland | Meridian Pharma AG (controller) | Laboratory results and QC data | Swiss adequacy decision (Art. 45) — European Commission Implementing Decision 2000/518/EC as maintained | N/A (adequacy) |
| NovaCure Therapeutics S.A. | India | Wipro Ltd (sub-processor — IT infrastructure support) | System metadata, incidental access to hosted data during support | EU SCCs Module 3 (processor-to-sub-processor), executed 2024-07-01 | TIA-2024-WIPRO-004 |
Sub-processor transfers: When the processor engages sub-processors in third countries, the processor must document these transfers in its Art. 30(2) record even though the controller's Art. 28 authorisation and Art. 30(1)(e) record should also reflect them.
Field 4: Security Measures — Art. 30(2)(d)
Provide a general description of the technical and organisational security measures implemented by the processor under Art. 32(1). This description should reflect the measures the processor actually applies to protect the controller's data.
Example security measures description:
Technical measures: Multi-tenant cloud infrastructure with logical tenant isolation using dedicated database schemas per controller. AES-256 encryption at rest (AWS KMS managed keys, per-controller keys). TLS 1.3 for all data in transit. Network segmentation with dedicated VPCs per tenant. Role-based access control with quarterly access reviews. Multi-factor authentication for all administrative and data access. Immutable audit logging with 2-year retention (AWS CloudTrail). Daily automated backups with cross-region replication and quarterly restore testing. Vulnerability scanning (weekly) and penetration testing (annually by NCC Group). Endpoint detection and response on all employee workstations.
Organisational measures: ISO 27001:2022 certified (certificate ref: IS 891245, scope includes LIMS hosting services). SOC 2 Type II audit completed annually (latest report: 2025-Q3). All staff with data access have completed background checks, signed confidentiality agreements, and undergo annual data protection training. Incident response procedure with 24-hour initial assessment and controller notification per Art. 33(2). Sub-processor management programme with security assessments prior to engagement and annual re-assessment. Data processing restricted to documented controller instructions per Art. 28(3)(a).
Processor RoPA vs Controller RoPA
| Aspect | Controller RoPA (Art. 30(1)) | Processor RoPA (Art. 30(2)) |
|---|---|---|
| Number of mandatory fields | 7 (a through g) | 4 (a through d) |
| Purposes documented | Yes — controller's processing purposes | No — only processing categories (what is done, not why) |
| Data subject categories | Yes | No — not required, though often included for completeness |
| Personal data categories | Yes | No — not required, though often included for completeness |
| Recipient categories | Yes | No — sub-processors are documented in the DPA, not necessarily in the Art. 30(2) record |
| Retention periods | Yes | No — retention is the controller's responsibility |
| International transfers | Yes | Yes |
| Security measures | Yes | Yes |
Per-Controller Record Separation
A processor must maintain separate documentation for each controller. In practice, this means:
-
Separate records per controller: Even if the processing activities are identical (e.g., hosting LIMS for multiple pharmaceutical clients), each controller must have its own entry documenting the processor-controller relationship, processing categories, transfers, and applicable security measures.
-
Shared infrastructure documentation: Where security measures are identical across controllers (same infrastructure, same controls), the security measures description may reference a common security practices document, but each controller's record must include or reference this description.
-
Controller-specific nuances: Different controllers may have different instructions, different data types, different sub-processor authorisations, or different transfer requirements. Capture these differences in each controller's record.
Sub-Processor Documentation
When the processor engages sub-processors under Art. 28(2)/(4), the processor's RoPA should reflect:
| Sub-Processor | Controller(s) Affected | Processing Activity | Location | Art. 28 DPA | Authorisation Type |
|---|---|---|---|---|---|
| Amazon Web Services EMEA SARL | All controllers | Cloud infrastructure hosting (IaaS) | Frankfurt, Germany (eu-central-1) | DPA-2024-AWS-001 | General written authorisation with notification obligation |
| Wipro Ltd | NovaCure Therapeutics S.A. | IT infrastructure support and monitoring | Bangalore, India | DPA-2024-WIPRO-003 | Specific written authorisation per controller |
| Datadog Inc. | All controllers | Application performance monitoring and logging | EU region (Dublin) | DPA-2024-DD-001 | General written authorisation with notification obligation |
Common Processor RoPA Mistakes
-
Not maintaining Art. 30(2) records at all: Many processors assume only controllers need RoPA. Art. 30(2) is an independent obligation with independent enforcement.
-
Documenting the controller's purposes instead of processing categories: The processor records what it does (hosts, stores, backs up, transmits), not why the controller collects the data.
-
Single record for all controllers: Each controller relationship must be separately documented, even if processing is identical.
-
Missing sub-processor transfers: When a sub-processor is located in a third country, the resulting international transfer must be documented in the processor's Art. 30(2)(c) field.
-
Copying the controller's security description: The processor must describe its own security measures, which may differ from the controller's. The processor's controls protect the data during processing, which may involve different infrastructure, different access patterns, and different threat models.
-
Ignoring the Art. 30(5) exemption limitations: Even small processors must maintain Art. 30(2) records if the processing is not occasional, involves special category data, or is likely to result in a risk to data subjects' rights. In practice, any processor providing ongoing services (hosting, payroll processing, cloud services) is processing non-occasionally and must maintain records regardless of employee count.