Glossary term
Records of Processing Activities (ROPA)
Subject: Technology, Cyber and Data, Data Protection and Privacy
Also known as: ROPA, Article 30 record, Record of processing
Records of processing activities are a written register, kept by controllers and processors, listing what personal data they handle, why, who receives it, how long it is kept and how it is secured.
Explanation
Article 30 of the GDPR requires the register, with a limited exemption for small organisations whose processing is occasional and low risk. For each activity, a controller records its purposes, the categories of people and data, recipients, transfers abroad, retention periods and a general description of security. A processor keeps a shorter record of what it does for each client. In practice the register is a spreadsheet or a privacy-management tool, built by interviewing business units and then updated when systems or uses change. It must be shown to the regulator on request. Beyond compliance, it is the base for notices, impact assessments, rights requests and breach response, since nobody can protect data they cannot locate. Regulators often ask for it first, and gaps in it point them to weak spots elsewhere.
Example
A retail chain builds its register by interviewing HR, marketing, finance and store operations. It finds that marketing has been sending customer lists to an agency not mentioned in the privacy notice. The entry is added to the register, a processing contract is signed with the agency, and the notice is corrected.
Not to be confused with
- Data Retention Schedule
- Lists how long each record type is kept. A processing register is wider and covers purposes, recipients and transfers as well.