UK GDPR Article 30 for Cloud Architects - Records of Processing in Multi-Cloud Environments

Understanding Article 30 Requirements

UK GDPR Article 30 mandates that organisations maintain written records of their processing activities. According to ICO guidance, this documentation serves as the foundation of your accountability obligations under UK data protection law.

For cloud architects, Article 30 compliance intersects directly with infrastructure decisions. Every data flow you design, every storage location you specify, and every third-party service you integrate must be captured in your organisation's Records of Processing Activities (ROPA).

Who Must Maintain ROPA?

The ICO confirms that organisations with 250 or more employees must document all processing activities. Smaller organisations have a limited exemption but must still document processing that:

• Is not occasional (regular, ongoing processing)

• Could result in a risk to individuals' rights and freedoms

• Involves special category data (health, biometric, racial origin)

• Involves criminal conviction or offence data

In practice, most cloud-based systems processing customer or employee data will require documentation regardless of organisation size.

Controller vs Processor Obligations

Cloud architects must understand the distinction between controller and processor roles, as documentation requirements differ:

As a Controller (you decide why and how data is processed), document:

• Your organisation's name and contact details

• Purposes of processing (customer management, marketing, HR)

• Categories of data subjects and personal data

• Categories of recipients (cloud providers, analytics vendors)

• International transfers and safeguards

• Retention schedules

• Technical and organisational security measures

As a Processor (you process data on behalf of others), document:

• Name and contact details of each controller you serve

• Categories of processing carried out for each controller

• International transfers and safeguards

• Security measures description

Mapping Cloud Services to ROPA

When architecting on AWS, Azure, or GCP, each service that processes personal data must be documented. Consider this mapping approach:

Compute Services (EC2, Azure VMs, Compute Engine):

• Document region deployment (e.g., Azure UK South, AWS eu-west-2)

• Record what personal data applications process

• Note encryption at rest and in transit configurations

Database Services (RDS, Azure SQL, Cloud SQL):

• Identify tables/columns containing personal data

• Document backup locations and retention periods

• Record access control mechanisms

Storage Services (S3, Blob Storage, Cloud Storage):

• Map bucket/container purposes to processing activities

• Document lifecycle policies (retention, deletion)

• Record cross-region replication if enabled

International Transfers in Cloud Architecture

Article 30 requires documentation of transfers to third countries. For UK cloud deployments, this means documenting:

1. Primary region: Where data is stored at rest (e.g., UK South)

2. Disaster recovery region: Where replicated data resides (Azure pairs UK South with UK West; AWS pairs London with Dublin)

3. Support access: Whether provider engineers outside UK can access data

4. SaaS integrations: Third-party services that may process data internationally

The ICO's international transfers guidance explains the safeguards required when data leaves UK jurisdiction.

Technical Controls Supporting ROPA

Cloud architects can implement technical controls that automate ROPA maintenance:

Data Discovery and Classification:

• AWS Macie for S3 data classification

• Microsoft Purview for Azure data governance

• Google Cloud DLP for sensitive data detection

Data Flow Mapping:

• AWS CloudTrail and VPC Flow Logs for access patterns

• Azure Monitor and Network Watcher for data movement

• GCP Access Transparency and VPC Flow Logs

Retention Automation:

• S3 Lifecycle Policies for automatic deletion

• Azure Blob Lifecycle Management

• Cloud Storage Object Lifecycle Management

ROPA Template for Cloud Environments

The ICO recommends maintaining ROPA as a living document updated as processing changes. For cloud architects, include:

1. Processing Activity Name: Customer Data Platform

2. Purpose: Unified customer view for marketing personalisation

3. Lawful Basis: Legitimate interest (with LIA documented)

4. Data Categories: Name, email, purchase history, browsing behaviour

5. Data Subjects: UK retail customers

6. Cloud Services: Azure UK South (Cosmos DB, Azure Functions, Blob Storage)

7. Recipients: Marketing automation vendor (Salesforce Marketing Cloud)

8. International Transfers: Salesforce US (SCCs in place)

9. Retention: 3 years from last interaction, automated deletion via lifecycle policy

10. Security Measures: TLS 1.3 in transit, AES-256 at rest, Azure AD RBAC, Customer Lockbox enabled

Data (Use and Access) Act 2025 Impact

The Data (Use and Access) Act 2025, which came into force in June 2025, introduces changes affecting documentation requirements. The ICO is updating guidance throughout Winter 2025/2026. Key changes include:

• Codified DSAR search requirements affecting how you document data locations

• New 'recognised legitimate interests' provisions simplifying some processing documentation

• Mandatory complaint handling procedures requiring documented processes

Cloud architects should monitor ICO guidance updates for changes affecting ROPA requirements.