GDPR Records of Processing Activities (Article 30 RoPA):The Ultimate Guide
Ensure GDPR compliance by creating and maintaining Records of Processing Activities (RoPA). Learn who needs a RoPA, the requirements, what it must contain, and how to keep it up-to-date. Explore a practical guide with a downloadable RoPA template.
). If you do not maintain such records, you violate the law.
Many website operators and business owners, in general, think that having a privacy policy and cookie banner is all they need for GDPR compliance. That's not true.
This clearly implies that the ROPA is needed for times when the data protection authorities knock on your door and request your Records of Processing Activities to get an idea of what is going on with personal data within your organization.
Until then, the ROPA needs to be kept up-to-date in your records.
Who needs to create and maintain a ROPA?
According to GDPR Article 30, a ROPA is obligatory for every data controller or processor that has more than 250 employees. Companies with fewer than 250 employees have to maintain an ROPA if they process sensitive personal data (special categories of data) or criminal conviction data.
For all the rest, having one is a good practice.
How is the record of processing activities different from the data map?
On the other hand, some data controllers and data processors require the ROPA, which a supervisory authority might also request.
How does a ROPA help personal data protection compliance?
The ROPA helps data protection compliance by ensuring that there is a record available to the supervisory body should they audit the privacy practices of a company. Furthermore, it helps by putting on paper, in a clear and concise way, the data flows within the company.
On one hand, it provides better clarity for the business. On the other hand, it helps the business be accountable.
What are the GDPR requirements of ROPA?
The GDPR prescribes who needs an ROPA, what it needs to contain, and who is exempt from the duty to maintain one.
What do ROPAs need to contain?
Article 30 has slightly different requirements for data controllers and data processors.
Data controllers are required to include:
The name and contact details of the controller and, where applicable, the joint controller, the controller’s representative, and the data protection officer
The purposes of the processing
A description of the categories of data subjects and of the categories of personal data;
The categories of recipients to whom the personal data has been or will be disclosed, including recipients in third countries or international organizations
Transfers of personal data to a third country or an international organization, including the documentation of suitable safeguards
Data retention periods, and
A general description of the implemented technical and organizational measures
The data processor's ROPA has to include:
The name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller’s or the processor’s representative, and the data protection officer
The categories of processing carried out on behalf of each controller
Transfers of personal data to a third country or an international organization, including the documentation of suitable safeguards, and
A general description of the implemented technical and organizational measures
There is no specific format in which this information must be kept. You are free to create it in any way that is suitable for your business, as long as it achieves its purpose.
However, you must ensure that the information inside is detailed.
Here's what it should not look like:
Purpose of processing analytics, marketing Data subject categories website visitors, email subscribers Third parties: recipients of data Google, Meta, Bytedance, and Mailchimp International Data Transfers United States
The table above is wrong. Instead, you should do it in the following way:
Data category Processing purpose Third parties: recipients International data transfers Email address marketing Mailchimp United States IP address analytics Google United States Device details analytics Google United States Device details (the field should be merged with the one above) marketing Google, Meta, and Bytedance United States
The table above is not complete either because there is not enough space on this web page to include all the information, but you get the idea about the level of detail needed for a GDPR-compliant ROPA.
Does the ROPA need to be published on the website?
The ROPA does not need to be published on your website. It is an internal record that should be available only to you and the data protection authorities in case they ask for it.
Your privacy policy (privacy notice) is the document that serves to inform your users how you process personal data. It is the only data-subject-facing document required on your website. The ROPA doesn't need to be there.
There are a few steps to take to create and maintain a ROPA:
Do a data mapping exercise to map out all the business's data processing activities. It will help you figure out how personal data flows in and out of your business and will do much of the work needed for an ROPA.
Involve all the stakeholders within the organization and ensure they give their feedback in the process. The marketing department, HR, the sales team, and your accountants all process personal information. Make sure that every single person who gets in touch with any category of personal data processed within your business contributes information.
Ensure you get updates from all the stakeholders when the organization's data processing activities change. The same people make changes to your practices and must update you whenever they make changes because such changes must be reflected in the Records of Processing Activities.
If your business starts collecting phone numbers from the next Monday, the records must contain information on phone number processing from the next Monday.
If you decided to delete the emails of unresponsive subscribers after six months instead of one year from the next Wednesday, you need to change the data retention periods. If you changed from Mailchimp to Brevo, make sure you update accordingly.
The ROPA informs what happens at this very moment with your data processing practices. It must change as they change.
