Skip to content
DEEN

5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026

Review your record of processing activities

Your RoPA must fit your processing.

We check your record under Art. 30 GDPR against the actual processing, close gaps precisely and structure it so it holds up in audits, customer reviews and dealings with the authority.

Enquire without details

The first contact is free of charge. We will expressly inform you before any costs arise.

Response within 24 hours on working days

As of: 23 October 2026

Schematic illustration of a RoPA review. Simplified example.

We review records for

  • Major customers
  • Investors
  • Authorities
  • Data protection officers

Key points at a glance

  • Under Art. 30 GDPR, controllers and processors must maintain a record of their processing activities and make it available to the supervisory authority on request.
  • In our experience, the critical issue is not the missing document alone but the gap between paper and actual processing.
  • At ITMR we review mandatory information, roles, recipients, deletion periods, transfers and the link to the DPA and DPIA.
  • You receive a record that you can explain to customers, investors and the authority.
  • Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.
DSGVO
The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
VVT
Record of processing activities under Art. 30 GDPR. It lists which data is processed for which purpose.
AVV
Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on your behalf.
DSFA
Data protection impact assessment under Art. 35 GDPR. It assesses the risks of a processing operation before it starts.

Typical occasion

When does the RoPA become a problem?

In our experience, the record is rarely revised at leisure. It becomes important when a major customer demands evidence, an authority wants to see documents or an investor carries out a review.

A RoPA must fit your processing, your roles and the rest of your documentation.

In our reviews it then turns out that new tools, service providers and international data flows are missing from the document. After growth, tool changes or the use of AI, the record exists but is no longer reliable.

In this situation, have gaps and priorities assessed first before the record is revised. Fundamental questions are answered on our data protection law page. This page is about a robust RoPA under specific pressure to provide evidence.

A good RoPA is a steering document. It helps with access requests, deletion, managing service providers, risk analysis, DPIA, due diligence and coordination between legal, data protection, IT and business units.

For whom
Controllers and processors
Provision
Art. 30 GDPR
Submission
On request of the supervisory authority
Form
In writing, including electronically

Clear priorities

Describe the occasion in the form. We will get back to you on working days within 24 hours with a first assessment.

How it works

How do we review your RoPA?

We work in three steps and set the pace according to the occasion.

  1. 01

    Record the status

    We assess why your RoPA is becoming important now and which processes, companies, tools, service providers and country links need to be reviewed first.

  2. 02

    Align the RoPA

    We review mandatory information, roles, legal bases, recipients, deletion periods, references to technical measures, transfers and the link to the DPA and DPIA.

  3. 03

    Make it audit-ready

    You receive a clear line for correction, prioritisation, evidence and the next step towards the customer, investor, data protection officer or authority.

What we specifically review in the RoPA

  1. 1Mandatory information

    Are purpose, data categories, recipients and storage period described precisely enough without becoming unusable in practice?

  2. 2Roles

    Are controllers, processors, joint controllers and group companies classified according to how they actually work together?

  3. 3Transfers

    Are service providers, subcontractors and third-country links taken into account? With cloud and US links, breaks appear between the RoPA, DPA, standard contractual clauses and actual use.

  4. 4Technical measures

    The RoPA does not have to duplicate the security documentation. But the reference must fit the protection architecture actually in place.

  5. 5Connections

    Does the interplay with the DPA, DPIA, deletion concept, data subject rights and response paths to authorities work?

  6. 6Maintenance

    Can the document be maintained internally? We clarify responsibilities, triggers for updates and approvals.

How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.

Service package

What do you have in hand after the review?

Service package: RoPA review

  1. Gap analysis

    Which processing operations, roles, recipients and transfers are missing or vaguely described?

  2. Prioritised corrections

    What needs to change before a customer audit, due diligence or submission to the authority, and what can follow?

  3. Revised record

    On request, we revise the record ourselves or with your data protection team.

  4. Maintenance process

    Responsibilities and triggers for updates so the RoPA stays current.

For whom
Controllers and processors
First response
within 24 hours on working days
Costs
We tell you the costs transparently before you instruct us.
Not included
Ongoing support as external data protection officer. That is a separate service, on request.
Have your RoPA reviewed

Who delivers what and who decides

What you provide
  • Current record
  • List of tools and service providers
  • Contacts in business units
  • Occasion and deadline
What we take on
  • Alignment with the processing
  • Role review
  • Proposed corrections
  • Maintenance process
Who decides
  • Your company decides on the version
  • In a dispute, the supervisory authority

How does the engagement work?

  1. 1
    First assessment

    You describe the occasion using the form. We assess where you stand. The first contact is free of charge.

  2. 2
    Offer

    Before work begins, we tell you the scope and costs transparently.

  3. 3
    Court steps separately

    We agree court proceedings and representation before supervisory authorities separately if you wish.

Client situations

When should you no longer wait with the RoPA?

The authority, a customer, investor, data protection officer, internal audit or new systems trigger most enquiries.

The document is to be submitted

When the authority requests documents or the data protection officer demands a clean version, it becomes apparent whether processing is documented in a current and consistent way. Improvisation then costs time and credibility.

Third parties want to see evidence

When selling to major customers, in groups, with investors or in transactions, a blanket “we have one” is not enough. A traceable line on roles, service providers, transfers and deletion periods is expected.

Practice has overtaken the RoPA

Customer databases, HR software, cloud, tracking, ticket systems, collaboration tools or AI features change processing faster than records are updated.

The role is unclear

In our experience, mistakes start with the role. Anyone who confuses controller, joint controller and processor also documents recipients, DPA needs and transfers incorrectly.

Risks

Which RoPA mistakes become visible when it matters?

We see these mistakes in our reviews.

Content
  • Only standard processes recorded Tracking, applications, AI use, automations or access from abroad are missing.
  • Roles adopted, not reviewed Controllership and processing on behalf do not fit the tool and contract structure.
  • Deletion periods only on paper It remains unclear whether they are implemented or linked to other rules.
Context
  • Blanket transfers Service providers, subcontractors or remote access from third countries are missing.
  • No alignment The RoPA was never aligned with the DPA, DPIA, privacy notices and access request process.
  • Cannot be explained The company can show the document but cannot explain why it reflects the current situation.

Good RoPA

How do you recognise a robust RoPA?

A good RoPA reduces friction in audits and turns an obligation into evidence of your organisation.

Overview instead of false security

Internally, it shows which processes are running, which service providers are involved and where storage periods, deletion routines and permissions connect.

Explainable, not just present

You can justify why this role, these recipients, these periods, this transfer route and this reference to technical measures were chosen.

Evidence instead of box-ticking

The goal is a record that makes audits easier and shows customers, investors and the authority that your organisation knows its processing.

Next routes

When is another service package a better fit?

Clear next routes prevent the RoPA from becoming a catch-all for other topics.

Audit or set-up

Data protection audit if the entire set-up is to be reviewed. Data protection set-up if responsibilities and documentation need to be reorganised.

Data processing agreement

When clarifying roles and contracts with service providers is the focus.

data protection impact assessment

When a risky processing operation is the focus.

Authority or court

Help with the supervisory authority if a letter or deadline is on the table. Privacy litigation if a fine, defence against claims or court proceedings are looming.

Data protection access requests

When the main task is answering data subject requests on time.

External data protection officer

When the RoPA is to be monitored and updated on an ongoing basis.

Legal framework

Which rules apply to the RoPA?

Art. 30(1) GDPR obliges controllers to maintain a record. Among other things, it contains purposes, categories of data subjects and data, recipients, third-country transfers, deletion periods and a general description of the technical and organisational measures.

Under Art. 30(2) GDPR, processors maintain their own record. The record must be kept in writing, including electronically, and made available to the supervisory authority on request under Art. 30(4) GDPR.

The exemption for companies with fewer than 250 employees under Art. 30(5) GDPR does not apply if the processing poses a risk, is regular or involves special categories of data. In our experience, it therefore rarely applies.

Sources

Limits

What does the RoPA review not cover?

The RoPA reflects the processing. It does not replace other obligations.

  1. 1
    No security review

    Specialised service providers check whether technical measures work. We check whether the reference in the RoPA is correct.

  2. 2
    Maintenance remains with you

    A RoPA is only as good as its update process. Without internal responsibility, it becomes outdated again.

  3. 3
    More expensive just before an authority deadline

    Under time pressure, gaps become visible that can be fixed in a more orderly way with lead time.

Mistakes we see in practice

  • A template is adopted without adapting it to the organisation.
  • Several companies share one record without clear allocation.
  • The RoPA is only tidied up when the authority asks.

Your contact

Dominik Skornia, LL.B.

Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer

View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124

At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.

ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.

What clients say

5,0 von 5 · 167 Google reviewsPeriod: October 2016 to date · As of: 28 October 2026

5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026

“I can definitely recommend the firm; Mr Skornia represented me superbly in the area of IT copyright.” (translated from German)
ruediger reinis · Google
“An excellent law firm, extremely friendly and helpful lawyers. An unreserved recommendation from me.” (translated from German)
Timon Boss · Google
“I would like to thank Mr Skornia for solving my problem quickly. Top work. Thank you” (translated from German)
Gamadriada YT · Google

FAQ

What do companies ask about the RoPA?

Is a DSK template or software template enough?

A template can help for the initial set-up. Advice is needed where it does not fit the organisation: with several companies, service provider chains, transfers, special categories of data, AI, tracking or audit pressure.

We have fewer than 250 employees. Do we need a RoPA?

In our experience, usually yes. The exemption under Art. 30(5) GDPR no longer applies if processing is regular, involves special categories of data or poses a risk to data subjects.

Does our processor have to keep its own record?

Yes, under Art. 30(2) GDPR. Controller, DPA and RoPA must fit together logically, and information must be obtainable along the chain.

When is a legal review worthwhile?

When roles are unclear, an audit or authority request is coming up, documents diverge, international data flows are involved or you will later have to defend your classification.

Can we tidy up the RoPA when the authority asks?

That is the most expensive option. Under time pressure, gaps and contradictions become visible that can be fixed in a more orderly and credible way with lead time.

Is the RoPA just a formality?

No. A good RoPA steers access requests, deletion, service providers, risk analysis, DPIA and due diligence and makes coordination between legal, data protection, IT and business units easier.

Next step

Does your RoPA need reviewing now?

The sooner it becomes clear which processing operations, roles and transfers are missing, the better you can manage the situation with customers, investors and authorities. As preparation, you can record sources, purposes and recipients with our data flow designer.

Helpful for your enquiry

  • Current record
  • Occasion and deadline
  • List of tools and service providers
  • Number of companies

You can also submit documents after our first response.

Have your RoPA reviewed

State the occasion and upload your record. We assess gaps and priorities.

Your contact details

Your message

e.g. deadline from an Abmahnung (formal warning letter)

Attach files

Upload relevant documents (optional)

FilesOptional

Helpful are the current record, the reason for the review, a list of tools and service providers and any deadlines.

Related services