Record of processing activities (ROPA)
Definition
The documented inventory a controller or processor keeps of its processing operations, including purposes, data categories, recipients, transfers, retention periods and security measures.
The record of processing activities (ROPA) is the backbone of accountability: without knowing what processing exists, an organisation cannot show it complies. GDPR Art. 30 lists the required content for controllers: name and contact details, purposes, categories of data subjects and data, recipients, international transfers and safeguards, retention periods where possible and a general description of security measures. Processors keep a shorter record of the processing carried out for each client. Small organisations have a limited exemption that rarely applies in practice.
The LGPD (Art. 37) requires controllers and processors to keep records of their processing operations, especially when based on legitimate interest, and the ANPD has simplified the duty for small processing agents.
A good ROPA is kept current, linked to DPIAs, contracts and retention schedules, and is the first document auditors and regulators ask for. In AI governance, it connects naturally with the AI inventory: each AI system that uses personal data should map to one or more ROPA entries.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 3: Accountability tools.
Also covered in: Responsible AI Auditor (AUDAI)
Primary sources
- GDPR Art. 30
- LGPD Art. 37