Build Your Article 30 Register (RoPA) — Without the Spreadsheet Nightmare
Controllers must maintain a Record of Processing Activities under the GDPR. Many organisations start in Excel and never finish: owners change, columns are half-empty, and audits expose gaps. Ghost's Article 30 Register walks you through each activity with the fields regulators expect, highlights missing entries, and exports a coherent register — while your actual HR PDFs and contracts stay out of this product unless you choose to attach metadata separately.
What a credible Article 30 register includes
The exact list differs slightly for controllers vs processors, but controllers typically document: the purpose of processing, categories of data subjects and data, recipients, third-country transfers, retention, and security measures. Supervisory authorities use the ROPA during investigations. An incomplete ROPA is a common finding.
- Name and contact details of your organisation and DPO
- Purposes of each processing activity
- Categories of data subjects and personal data
- Recipients and transfers to third countries
- Retention periods
- Technical and organisational security measures
Gap analysis before the auditor arrives
Ghost compares your entries against regulator-style processing inventory (ROPA) expectations and surfaces empty or weak fields. That turns "we should fix the ROPA someday" into a concrete task list owned by DPOs and process owners.
Exports your stakeholders can read
Download PDF or Excel for board packs, DPIA appendices, and DPA schedules. Formatting is consistent so you are not pasting from twenty different tabs the night before a deadline.
Prefer to start in a spreadsheet? Grab our free starter RoPA CSV (Article 30–style columns), then move into the builder when you need structure and reviews.
How the Article 30 register relates to redaction
Redaction tools address disclosure. Your Article 30 register addresses transparency and accountability about processing. You will list activities like HR administration and SAR handling in the register. When you use Ghost for PDF redaction, describe that processing activity and third-party relationship in line with your DPIA habits. See our security page for architectural details you can reference. Ghost stores processing inventory (ROPA) structured data for the register workflow.
Pricing snapshot
Start with free-tier activity limits. Pro unlocks unlimited activities and clean exports. See the pricing page for current numbers.