Template Record of Processing Activity

Summary

This is a template document published by the Jersey Office of the Information Commissioner (JOIC) to help organisations create a Record of Processing Activities (RoPA) as required under the Data Protection (Jersey) Law 2018. It is guidance material, not a binding regulatory instrument, and must be adapted to each organisation's circumstances.

• Legal basis: Article 6 requires controllers to demonstrate compliance with data protection principles; Article 14(3) requires controllers to maintain a written record of processing activities and processors to maintain a record of categories of processing carried out on behalf of a controller.
• Availability to JOIC: These records must be made available to the JOIC on request.
• Scope of formal requirement: A formal RoPA is only mandatory for larger or higher-risk processing operations, though JOIC encourages all organisations to keep an appropriate record as part of their accountability obligations under Article 6(3).
• Template content: The template itself sets out the fields to record for each processing activity: processing name, controller/processor, purpose, legal basis, categories of data subjects and personal data, recipients, international transfers and safeguards, retention period, security measures, systems used, and DPIA status, illustrated with worked examples (CRM, AML client onboarding, payroll processing).

The document is explicitly for illustrative and general guidance only and does not constitute legal advice; organisations must assess their own record-keeping obligations case by case and can contact JOIC for official guidance.

Key obligations

• Controllers must maintain a written record of all processing activities (RoPA) for which they are responsible.
• Processors must maintain a record of all categories of processing carried out on behalf of a controller.
• Controllers and processors must make these records available to the Jersey Office of the Information Commissioner (JOIC) on request.
• Organisations conducting larger or higher-risk processing operations must maintain a formal RoPA; other organisations are encouraged to maintain an appropriate record as part of their accountability obligations under Article 6(3).

Applies to

data controllers, joint-controllers, data processors, organisations handling personal data in Jersey