Under Article 30 of the GDPR controllers and processors of personal data must document their processing activities; this is known as a Record of Processing Activities (ROPA).
A controller’s ROPA must include:
• the name and contact details of the controller and, where applicable, any joint controller, the controller’s representative and the data protection officer
• a list of all the categories of personal data records which the controller processes and the data subjects they relate to
• the purposes of the processing activities
• details of any recipients with whom personal data is shared
• details of international transfers and how these are protected
• the period for which each category of personal data is retained (where possible)
• details of what technical and organisational security measures are in place to protect the personal data processed (where possible)
A processor’s ROPA must include:
• the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller’s or the processor’s representative, and the data protection officer
• a list of all the categories of personal data records which the processor processes on behalf of each controller and the data subjects they relate to
• details of international transfers and how these are protected
• details of what technical and organisational security measures are in place to protect the personal data processed (where possible)
Regulators may also have additional guidance on what should be included in the ROPA. For example, the ICO has guidance on what good practice looks like for a ROPA and there are definite advantages to recording more than just the basics.
Maintaining a ROPA is a good way to demonstrate compliance with a number of obligations under data protection laws; it can help you keep a record of the Legitimate Interest Assessments and Data Protection Impact Assessments which need to be undertaken or reviewed. It is also a useful way of recording the legal bases which you rely on for processing and will help you identify when you are processing special category data and criminal offence data. You will need to provide your ROPA to a data protection supervisory authority if they ask to see it.
You need ensure your ROPA is kept up to date by reviewing it regularly and having systems in place to ensure that new/changed processing activities are recorded. We recommend the ROPA is created in an electronic format so information can be added, amended and removed with ease. Maintaining an up to date, accurate record of what personal data you are processing is also a huge time saver when responding to data subject rights requests.
If you would like any assistance with the creating a ROPA that can help you with your overall compliance, please get in touch here.
