How to Create and Maintain an Effective RoPA

Written by admin

A practical guide to RoPAs, covering what to include, the format requirements and when to review them.

RoPA stands for Record of Processing Activities. It is a document that a business or organisation maintains to record how it collects, uses, stores and shares personal data. It is a legal requirement under UK GDPR.  

How To Get Started With Creating a RoPA

To start creating an effective RoPA, you must assess your resources. Are you able to use a tool or will you be using a spreadsheet? Who will manage the RoPA and how?

Your RoPA should be fit for your business, easy to maintain and understand. Ideally, it shouldn’t be granular, but not too in-depth; otherwise, you may end up with thousands of entries that are impossible to maintain correctly or efficiently. 

You should also have stakeholder buy-in from your organisation’s leadership to establish a top-down security culture. 

What Are the Core Elements Required in a RoPA?

The core elements required in a RoPA depend on whether your organisation is a data controller or a data processor.

If You’re a Data Controller:

Element Description
Contact details The name and contact details of your organisation, your joint controller, representative and Data Protection Officer. 
Purposes of processing A clear description of the reason why you are collecting and processing the personal data.
Categories of data subjects The groups of people whose data you collect, e.g. employees, customers and suppliers. 
Categories of personal data The types of data being processed, e.g. names, financial data and health records.
Categories of recipients Anyone who receives or will receive the data, including third-party processors, partners or other authorities
International data transfers Details of any data transferred outside the EU/EEA, including the name of the country or international organisation, and the documentation of security safeguards.
Retention periods The time limits for erasing the different categories of data.
Technical and organisational security measures A general description of the security safeguards in place to protect the data.

If You’re a Data Processor:

Data processors are required to maintain records on behalf of all data processed for the controller, including:

Element Description
Contact details The name and contact information of the processor, each controller you work for and your DPO, if applicable.
Categories of processing The types of processing operations carried out on behalf of each controller.
International data transfers Details of data transfers outside the EU/EEA.
Technical and organisational security measures A general description of your security safeguards.

How Must RoPAs Be Formatted?

There is no specific format mandated for RoPAs. However, Article 30 of the GDPR states that a RoPA must be in writing. This can be in paper or electronic form, though most organisations will benefit from an electronic RoPA as it is easier to maintain. 

If you’re using a spreadsheet, use tabs, standardised dropdowns and granular rows to keep things clear, consistent and clean.

How Often Should RoPAs Be Reviewed?

RoPAs should be reviewed at least annually, as well as whenever there is a change in how your organisation processes data. The information should be kept up to date, ready to present to regulatory authorities at any given moment. 

Need Support With Your RoPA?

At Data Protection People, we can support you in a number of ways. Whether you’re looking for RoPA training for your in-house team, general GDPR support or you’re in need of a DPO, we’re here to make RoPAs simple and easy. Get in touch with the team today.