Record of processing activities

A record of processing activities, also called a processing register or ROPA, lists what you do with personal data: each activity, why, whose data, which data, who receives it, how long you keep it and under which legal basis. It is the detailed, internal record behind your public privacy policy.

#Start from ready-made activities

Privacyboard offers 16 common activities, each prefilled:

• Customer accounts and service delivery
• Billing and payments
• Customer support
• Contact form and general enquiries
• Prospects and sales contacts
• Online orders and delivery
• Text messages and phone communications
• Online advertising and retargeting
• Newsletter and marketing emails
• Website analytics and cookies
• Security and access logs
• Supplier and partner management
• Employee records and HR administration
• Payroll
• Recruitment
• Service delivered on behalf of clients

You can also add your own activity and fill in every field yourself.

#Suggestions from your tools

When you add a tool, matching activities are suggested. Add a payment provider and billing is suggested, add an email tool and newsletters are. You add each suggestion in one click and check its fields.

#The fields of an activity

Plain explanations are shown next to retention and legal basis.

#One source for your documents

The activities you record are the ones your privacy policy describes, and processing for clients leads to the data processing agreement.

#Export

Export the register as a PDF or an Excel file, with the recipients and the transfers outside the EEA computed from your vendors. See Export the register.

#What the GDPR asks

Article 30(1) lists what a controller's record contains: identity and contact, purposes, categories of people and data, recipients, transfers outside the EEA, planned retention and a general description of security measures. Article 30(2) gives processors their own record. Article 30(5) exempts organisations under 250 employees only when processing is occasional, unlikely to risk people's rights and free of special categories or criminal data.

#FAQ

#Do small businesses need a record of processing activities?

Often yes. The exemption applies only when processing is occasional, unlikely to risk people's rights and free of special categories. Regular processing such as customer accounts or payroll usually means a record is needed. When in doubt, keeping one is a sensible default.

#Where do the prefilled values come from?

They are common values for each type of activity, written in plain words, and always yours to edit. Nothing is confirmed until you check it.

#What if I act for clients?

Choose the processor role for that activity. Processing on behalf of clients also leads to the data processing agreement.

#Is the register free?

Yes. It is part of the free workspace.