What is a Record of Processing Activity?

A record of processing activity (ROPA) is a document that organisations are required to maintain under the General Data Protection Regulation (GDPR). It is a detailed inventory of an organisation’s data processing activities, providing insights into the types of personal data processed, the purposes for which it is processed, and the recipients of the data.

What is a Record of Processing Activity?

A record of processing activity is a document that records all of the processing of personal data that your organisation undertakes. It is central to GDPR compliance because it is the single, central repository of all of the ways your organisation uses data about people.

It will therefore cover anything to do with employees, customers, suppliers and other stakeholders who have a relationship with you.

Statutory Requirement for a ROPA

A record of processing activity is a statutory requirement for larger organisations. Article 30 of the GDPR mandates it, and in the UK your ROPA must be made available to the authorities on request. Article 30 also sets out the types of information it should contain. Therefore a record of processing activity is not something useful – it is a must do for GDPR compliance.

Exceptions to the Law

Organisations that employ fewer than 250 people do not need to keep a record of processing activities unless they process details of:

• special category data such as health, gender or political views (see more about special category data here).

• details of criminal convictions

In addition frequent or regular data processing does mean a ROPA is still needed no matter how large the organisation. Finally a ROPA is still required if the processing poses risks to people’s rights and freedoms.

Therefore small businesses do not get a blanket exception to having a ROPA.

Purpose of a Record of Processing Activity

The record of processing activities serves several key purposes for organisations:

1. Transparency: It enables organisations to demonstrate their compliance with the GDPR’s transparency obligations by providing clear information about their data processing activities.

2. Data Minimisation: It helps organisations ensure that they are only collecting and processing the personal data that is necessary for the specific purposes for which it is intended.

3. Risk Assessment: It provides a foundation for organisations to conduct data protection impact assessments (DPIAs) by identifying potential data protection risks related to their processing activities.

4. Audit Capability: It facilitates internal audits and external audits, allowing organisations to demonstrate their compliance with data protection requirements.

5. Data Subject Requests: It enables organisations to effectively respond to subject access requests (SARs) by providing easy access to information about the personal data being processed.

Content of a Record of Processing Activity

The record of processing activities should include the following information:

1. your organisation’s name and contact details, whether it is a controller or a processor (and where applicable, the joint controller, their representative and the DPO);
2. the purposes of the processing;
3. a description of the categories of individuals and of personal data;
4. the categories of recipients of personal data;
5. details of transfers to third countries, including a record of the transfer mechanism safeguards in place;
6. retention schedules; and
7. a description of the technical and organisational security measures in place.
8. You have an internal record of all processing activities carried out by any processors on behalf of your organisation.
9. Data retention periods: Details of the periods for which the organisation retains personal data. You can read our guide to developing a retention period here.

Other Things to Consider

Best practice for a record of processing activities means also including where possible:

• details of any controller-processor contracts or data sharing agreements

• any data privacy impact assessments done to mitigate the risks of data processing

• records of consent given by data subjects for the processing of their data

• a link to your publicly available privacy statement to ensure the two documents are consistent

Updating your Record of Processing Activity

The record of processing activities should be updated regularly as the organisation’s data processing activities change. This could be quarterly, annually, or more frequently depending on the frequency of changes and the sensitivity of the data being processed.

Need Help with GDPR Compliance?

We can help you with your GDPR compliance by:

• delivering training to you and your team, giving you the skills and confidence to meet your statutory duties

• providing data protection officer services

• auditing and reviewing your ROPA, policy documents,

• and other GDPR requirements

Get in touch to find out more.

Gain the practical skills you need to identify and manage data protection and GDPR with this five-star rated training course.

Available in person, online or in-house the focus on practical skills and unique post-course support you get by learning with us will ensure you and your organisation can tackle this key governance activity with confidence.