RoPA

Also known as: Records of Processing Activities

A Record of Processing Activities is the documented record of what an organisation does with personal data: each activity, its purpose, the categories of data and data principals, recipients, retention period and lawful basis.

It differs from a data inventory, which lists where data lives; the inventory is an input to the RoPA. A RoPA rebuilt annually from a questionnaire is accurate the day it closes and decays from then on.