Record of processing activities

In short: The record of processing activities (RoPA) is an internal list in which a company documents which personal data it processes for what purpose.

In more detail: For each processing operation you state purpose, categories of data subjects and data, recipients, third-country transfers, deletion periods and technical safeguards. The duty in principle also applies to small businesses if processing is not merely occasional.

In Depth

• Example entries: user accounts, newsletter, order handling, support tickets, server logs, payment handling.
• Benefit: overview, basis for the privacy policy and for access requests.
• Maintaining: Update with new features and service providers.
• Template: Supervisory authorities provide samples.
• Showing: on request of the supervisory authority.

See also: Data processing agreement, Data protection impact assessment