A Record of Processing Activities (ROPA) is a requirement for some organisations under Article 30 of the GDPR. Its purpose is to help demonstrate that an organisation processes personal data in accordance with the data protection principles. It identifies how the organisation processes personal data and the activities which it undertakes.
Contents of the Record of Processing Activities
Your ROPA must contain the following:
- The name and details of your organisation (and where applicable, of other Controllers, your representative, and Data Protection Officer)
- The reasons for the processing of personal data
- A description of the categories of individuals and categories of their personal data
- Categories of recipients of personal data
- Details of any transfers to third countries including the safeguards in place
- How long personal data is retained
- A description of technical and organisational security measures
Who needs to Produce a RoPA
A ROPA must be maintained if an organisation:
- employs 250 or more employees
- processes personal data which might result in a risk to the data subject
- processes personal data which includes special categories of data
- processes personal data relating to criminal convictions and offences; or
- processes personal data in a way which is not occasional
In the event of an investigation the supervisory authority may request these records and having them in place may mitigate any sanctions.
How can ProvePrivacy Help?
The RoPA is one of the key modules built into ProvePrivacy, it allows an organisation to identify their activities and undertake assessments across Transparency, Lawful Basis, High Risk, Data Management and Data Sharing. ProvePrivacy identifies risks and record these so that they can be managed.
