AlanM

In case it helps... The UK GDPR states what a ROPA needs to have in it. https://www.legislation.gov.uk/eur/2016/679/article/30 The ICO makes a distinction between ROPA requirements and ROPA good practice. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/accountability-framework/records-of-processing-and-lawful-basis/#Good-practice You may wish to consider what information beyond the statutory items would be useful to you e.g. you could have a risk rating where items containing child and/or special category data are considered high risk and therefore require extra care.