RoPA Pilot

A filled GDPR Article 30 register (sample)

This is what a usable register looks like: three complete records from a 30-person company, carrying the seven items of Article 30(1). It is exactly the document RoPA Pilot produces — as a PDF, with cover page and table of contents, from the SaaS it detects.

Install the free extension
Controller
Example Ltd — 12 rue des Lilas, 75011 Paris
Legal representative
Camille Durand, CEO — contact@example.com
Data protection officer
Alpha DPO — dpo@example.com
Established on
2026-07-10 — kept in electronic form, Article 30(3)
Processing no. 1
Customer relationship management (CRM)
Purpose
Commercial follow-up of prospects and customers, sales cycle management
Lawful basis
Legitimate interest (Art. 6(1)(f)) — business development
Data subjects
Prospects, customers, professional contacts
Data categories
Identity, professional contact details, interaction history
Recipients
HubSpot Inc. (processor), internal sales team
Non-EU transfer
United States — EU-US Data Privacy Framework (certification checked on 2026-06-12)
Retention
3 years from last contact for prospects; contract duration + 3 years for customers
Security measures
Mandatory SSO + MFA, access logging, encryption at rest and in transit
Processing no. 2
Payroll and personnel files
Purpose
Producing payslips and social security filings
Lawful basis
Legal obligation (Art. 6(1)(c))
Data subjects
Employees, apprentices, interns
Data categories
Identity, national ID, bank details, HR data, family situation
Recipients
Payfit (processor), accountant, social security bodies
Non-EU transfer
None — hosted in France
Retention
5 years for payslips; 50 years for the digital duplicate given to the employee
Security measures
Named authorisations, HR segregation, encryption, encrypted backups
Processing no. 3
User support and assistance
Purpose
Handling support requests and satisfaction follow-up
Lawful basis
Performance of a contract (Art. 6(1)(b))
Data subjects
Customers, end users
Data categories
Identity, contact details, ticket content, technical data (browser, error log)
Recipients
Zendesk Inc. (processor), support team
Non-EU transfer
United States — standard contractual clauses + transfer impact assessment dated 2026-02-04
Retention
Contract duration + 1 year; 13 months for technical data
Security measures
Restricted support access, anonymisation of closed tickets, MFA

What this sample demonstrates

  • No empty cell. “Retention: to be defined” is the most common defect found during an inspection. Every duration must be backed by a legal text or a written internal policy.
  • The transfer is dated. Writing “DPF” is not enough: a vendor's certification can be withdrawn. Recording the verification date is what proves diligence.
  • The processor is named, not the product: “HubSpot Inc.”, not “the CRM”.
  • Lawful basis is distinct from purpose. Article 30 does not explicitly require it, but Article 5(2) requires you to demonstrate it.

The same register, generated automatically

RoPA Pilot recognises HubSpot, Payfit and Zendesk by domain, pre-fills the processor, data categories, typical purpose, transfer mechanism and suggested retention. You validate the lawful basis, adjust the durations and describe your security measures — the skeleton is already there.

Keep reading

Generate yours in minutes

The free tier already exports to CSV and JSON. The watermarked PDF preview is open to everyone.

Install the free extensionSee a sample register