Which RoPA type should you use in dot.legal?
dot.legal supports three RoPA types: Standard Article 30 RoPA (Controller), Extended RoPA (Internal Use), and Processor RoPA (Article 30(2)). This article helps you identify which type fits your organisation's role and what each type records.
Quick answer: Choose the Standard Article 30 RoPA if you are a data controller, the Extended RoPA for internal governance, or the Processor RoPA if your organisation acts as a data processor under GDPR Article 30(2).
1. Standard Article 30 RoPA (Controller)
Use this type if your organisation acts as a data controller. It is the standard compliance record required under GDPR. Note that organisations acting as both a controller and a processor should maintain separate records for each role:
- Follows the structure of GDPR Article 30(1)
- Includes data subject types, categories of personal data, recipients and retention periods
2. Extended RoPA (Internal Use)
This type gives a fuller picture for internal governance. It contains:
- Name, business area, description and purpose
- Personal data and data subjects
- Legal basis and basis for disclosure
- Retention periods
- Security measures
- Linked assets (systems)
- Recipients in the EU, in safe third countries and in unsafe third countries
- Transfer basis
That is the full content of the Extended RoPA. Legal basis appears only in this view, not in the Standard Article 30 RoPA.
Tip: Use this version for internal quality checks, Data Protection Officer (DPO) reviews, or management reporting. Note that this type is not required for regulatory submission to a supervisory authority and cannot be used as a substitute for the Standard Article 30 RoPA when fulfilling GDPR Article 30(1) obligations.
3. Processor RoPA (Article 30(2))
The Processor RoPA is designed for organisations acting as data processors under GDPR Article 30(2) — that is, organisations processing personal data on behalf of a controller — this version records:
- Processing instructions received from the controller
- Security measures implemented
- Sub-processors used
How to change your RoPA type in dot.legal
To change the RoPA type for an existing processing activity, open the activity, navigate to the Settings or Type field, and select the appropriate RoPA type from the dropdown. Changes take effect immediately. Note: Switching to a type with fewer fields may hide data previously entered in those fields. Review your activity data after changing the type to ensure nothing critical has been removed. Not sure which type fits your needs? See the descriptions above.