Records of Processing Activities (RoPA)

What is a record of processing activities?

A record of processing activities (RoPA) is an internal document, required by GDPR Article 30, that lists how your organization uses personal data. It is often a spreadsheet with one row per activity, such as payroll, customer support or product analytics.

There are two kinds. As a controller (deciding why data is used), your record must include, among other things:

• Why you process the data.
• Whose data it is and what types of data are involved.
• Who receives the data, including recipients in other countries.
• Transfers outside the EU and the safeguards used.
• Where possible, how long you keep it and a general description of your security measures.

As a processor (handling data for a customer), you keep a shorter record of what you process for each customer and any transfers. You must show either record to a regulator on request.

Why it matters to you

The "recipients" in your record include your vendors. Your cloud host, email platform, CRM and AI tools all receive personal data. When a vendor adds a subprocessor, moves data to a new country, or changes how long it keeps data, a row in your record may become wrong.

There is a small business exemption, but it is narrow. Article 30(5) exempts organizations with fewer than 250 employees, unless the processing is likely to create a risk to people's rights, is not occasional, or includes special categories of data (such as health data) or criminal records. Processing customer data every day is hard to call occasional. If you have EU users, assume the record applies to you and check with counsel.

Your record also helps with other work. It is the starting point for a DPIA, for answering a data subject access request, and for filling in a customer's security questionnaire.

What to check

• Start from your vendor inventory. Every vendor that touches personal data should appear as a recipient somewhere in your record.
• For each vendor, note the data types it receives, where it processes them, and the transfer safeguard in its DPA.
• Record each vendor's retention period from its DPA or privacy policy, not from memory.
• Add a review date to each row, and recheck rows when a vendor changes its DPA, privacy policy or subprocessor list.

How Venpo helps

Venpo watches your vendors' DPAs, privacy policies and subprocessor lists and emails you a plain-English alert when one changes. That tells you which rows of your record to revisit. The Fine Print Scan's data retention answer for each vendor also gives you a starting point for the retention column.