DPO Appointment & Record of Processing (ROPA) Compliance Check

UK GDPR Article 30 requires most organisations to keep a written record of their processing activities (often called a ROPA). Small businesses with fewer than 250 staff are only partly exempt: the exemption falls away if processing is regular, risks people’s rights, or includes special category or criminal offence data, which covers most employers holding health or HR records. The ICO routinely asks for the record at the start of an investigation, and a missing or out-of-date ROPA is one of the quickest ways to look non-compliant.

Articles 37 to 39 separately require a Data Protection Officer where you are a public authority, carry out large-scale regular monitoring of individuals, or process special category data on a large scale. A DPO must be independent, properly resourced and not given a conflicting role. The Data (Use and Access) Act 2025 also introduces a “senior responsible individual” concept for public bodies, so it is worth confirming which obligations apply to you. Infringements of these duties can attract fines of up to £8.7 million or 2% of worldwide turnover.

Use this free tool to check whether you need a Data Protection Officer and whether your record of processing would stand up to an ICO request. Get a personalised action plan in minutes.