A record of processing activities (ROPA) is a written inventory of the ways an organisation processes personal data: what it collects, why, about whom, who receives it, where it goes and how long it is kept.

Where the requirement comes from

GDPR and UK GDPR, Article 30 require controllers to keep a record that includes:

  • The name and contact details of the controller and, where applicable, the data protection officer
  • The purposes of processing
  • The categories of data subjects and personal data
  • The categories of recipients
  • Transfers to third countries and the safeguards used
  • Envisaged time limits for erasure, where possible
  • A general description of technical and organisational security measures, where possible

Processors must keep a similar record of the processing they carry out for each controller. Organisations with fewer than 250 employees are exempt unless the processing is likely to result in a risk to individuals, is not occasional, or includes special category or criminal offence data. In practice, most organisations are not exempt.

Other laws expect similar documentation. POPIA section 17, for example, requires a responsible party to maintain documentation of all processing operations under its responsibility.

Why it matters beyond compliance

A good ROPA is the map behind almost every other privacy task: answering access requests, assessing vendors, running DPIAs and responding to breaches.