Record of processing activities (ROPA)
Learn what a record of data processing activities is.
Definition of the record of processing activities
The record of data processing activities provides a clear and structured mapping of all personal data processing operations and will be the starting point for control by the Data Protection Authority.
The record is provided for in Article 30 of the GDPR. It participates in the documentation of compliance.
As an inventory and analysis document, it must reflect the reality of your personal data processing and allow you to precisely identify:
the stakeholders (representative, subcontractors, co-managers, etc.) involved in the data processing,
the categories of data processed,
what the data is used for (what you do with it), who accesses the data and to whom it is communicated,
how long you keep it,
how it is secured.
Why a registry?
The record is made mandatory by Article 30 of the RGPD. Beyond the response to the obligation provided for by Article 30, the record is a tool for monitoring and demonstrating your compliance with the RGPD.
It allows you to document your data processing and to ask yourself the right questions: do I really need this data for my processing? Is it relevant to keep all the data for so long? Is the data sufficiently protected? Etc.
Its creation and updating are thus an opportunity to identify and prioritize the risks with regard to the RGPD. This essential step will allow you to deduce an action plan for the compliance of your processing with the data protection rules.
Which companies are affected by the obligation to complete a record?
All companies processing personal data of European citizens are concerned by the obligation to fill a register.
Companies with less than 250 employees benefit from a derogation with regard to record keeping. They are required to record only the following data processing operations:
Non-occasional processing (e.g. payroll management, customer/prospect and supplier management, etc.);
processing operations likely to involve a risk to the rights and freedoms of individuals (e.g. geolocation systems, video surveillance, etc.);
processing that involves sensitive data (e.g. health data, offenses, etc.).
In practice, this exemption is therefore limited to very specific cases of processing, implemented on an occasional and non-routine basis, such as a communication campaign for the opening of a new establishment, provided that such processing does not raise any risk for the data subjects. If there is any doubt as to whether this exemption applies to a processing operation, the CNIL recommends that you include it in your record.
Content of the processing record
Article 30 of the GDPR sets out specific obligations for the personal data controller record and the processor record. If your organization acts as both a processor and a data controller, your record must therefore clearly distinguish the two categories of activities.
In practice, in this case, the CNIL recommends that you keep 2 records:
one for the processing of personal data for which you yourself are responsible,
another for the processing operations that you carry out, as a processor, on behalf of your clients.
The "Data controller" record in Dastra
For each processing operation, the record of a data controller shall indicate at least:
where applicable, the name and contact details of the joint controller of the processing carried out,
the purposes of the processing, the objective for which you have collected the data,
the categories of persons concerned (customer, prospect, employee, etc.),
the categories of personal data (e.g. identity, family, economic or financial situation, banking data, connection data, location data, etc.),
the categories of recipients to whom the personal data has been or will be communicated, including the processors you use,
transfers of personal data to a third country or to an international organization and, in certain very specific cases, the guarantees provided for these transfers,
the time limits for the deletion of the various categories of data, i.e. the retention period, or failing that the criteria for determining it,
to the extent possible, a general description of the technical and organizational security measures that you implement.
Stakeholders
The identity and contact information of the data controller
The identity and contact information of the DPO if applicable
The identity and contact information of the representative, if any
The joint controller(s), if any
Purposes
All purposes related to the activity involving the processing
Legal basis
Compliance with a legal obligation
Fulfillment of a contract
Legitimate interest of the company or a third party
Public interest
Consent
Safeguarding the vital interests of the data subject or another person
Inventory of data and data subjects
Type of data subjects
Categories of data
Time limits for deleting data or applicable rule
Recipients and data transfers outside the EEA
Identification of recipients including internal recipients (department concerned by the processing); external bodies (commercial or institutional partners); subcontractors (host, solution provider); data subject where applicable and joint managers
For each recipient, identification of transfers outside the European Economic Area (EEA) and the legal tools used (Binding corporate rules in the case of transfers outside the EU with subsidiaries, standard contractual clauses, country recognized as adequate, etc.)
Security measures
Technical and organizational measures implemented to secure each data processing
For example, data encryption, pseudonymization, access limitation
The "Processor" record in Dastra
Each processor is required to fill out a less extensive record.
This record contains:
the contact details of the processor, its representative, if any, and its DPO
the contact details of all data controllers on whose behalf the processor acts (usually the clients)
the categories of data processed
the recipients
transfers outside the EEA
the security measures
For more information
Record of processing activitiesEstablish your recordComplete a data processing activityDernière mise à jour
