The ICO publishes a free ROPA template as an Excel spreadsheet. It covers the Article 30 requirements and it is a perfectly reasonable starting point. This page explains where the template stops and where a working tool picks up.
We are not going to pretend the ICO template is bad. It is not. It was written by the regulator itself and covers the fields required under Article 30. For a business with fewer than a dozen processing activities and someone willing to maintain the spreadsheet, it works. The question is whether it keeps working as your business grows, your vendor list changes, and the DUAA deadline arrives.
| Feature | Rowpa | ICO template |
|---|---|---|
| Cost | Free tier available, paid from £49/mo | Free |
| ROPA format | Web app with structured data, exports to PDF/CSV | Excel spreadsheet (.xlsx) |
| AI classification | AI classifies activities, suggests legal bases and retention | Manual entry only |
| Vendor DPA tracking | Library with verified DPA URLs, sub-processors, transfer mechanisms | Manual columns if you add them |
| Privacy notice | Auto-generated from ROPA | Not included |
| DSR workflow | Public intake form, AI-drafted responses, deadline tracking | Not included |
| DUAA complaints procedure | Built-in, public intake, audit trail | Not included |
| Trust Center | Public URL with ROPA summary, sub-processors, DSR, complaints | Not included |
| Version history | Full audit trail, timestamped changes | Whatever Excel or SharePoint tracks |
| Site scanner | Detects third-party trackers and vendors on your site | Not included |
| Multi-user access | Role-based access on paid plans | Shared file access (OneDrive, email) |
| Maintenance | AI flags when records need updating | You remember to open the file |
The ICO's ROPA template covers the Article 30(1) and 30(2) fields: purposes, categories of data subjects, categories of personal data, recipients, transfers, retention periods, and security measures. It is structured, free, and comes from the regulator. If you are a micro-business with a handful of processing activities and you want to understand what a ROPA looks like before committing to any tool, downloading the template is the right first step. Rowpa's free tier exists for the same reason: start without spending anything.
The template is static. It does not know when your vendor list changes. It does not flag that a retention period you set 18 months ago no longer matches your legal basis. It does not generate a privacy notice from the data you entered. It does not track DSR deadlines. It does not produce a complaints procedure. It does not publish a Trust Center. Every one of those things has to be done separately, manually, and kept in sync with the spreadsheet. For businesses with 20+ vendors and 15+ processing activities, the maintenance burden is where the spreadsheet approach fails - not at setup, but six months later when nobody has opened the file.
From 19 June 2026, the Data Use and Access Act requires a documented complaints procedure. The ICO template does not include this because it predates the DUAA. You would need to build the complaints procedure separately, host it publicly, track 30-day acknowledgement deadlines, and maintain an audit trail. Rowpa includes all of this as a built-in feature.
If you are a solo freelancer with 5 processing activities, 3 vendors, and no EU data transfers, the ICO template plus a privacy notice template from the ICO website may genuinely be all you need. There is no reason to pay for a tool if your compliance surface is that small. Rowpa's free tier covers this exact scenario (1 user, 5 ROPA activities, 40 vendors), but so does the spreadsheet.
Start free. Bring your existing ROPA data with you.
Start free trial