Record of Processing Activities or ROPA

Under Article 30 of GDPR, each Controller is required to maintain a record of processing activities (aka ROPA) under its responsibility. The purpose of a ROPA is to document the lifecycle of data subject data. This includes where the data came from, or its sources, what is done to the date (processing), when to delete or remove the data, and who the data may be shared with.

Commonly associated evidence:

• Record of PII Processing Compliance

• Sensitive PII

Who needs a policy like this?

• Organizations that adhere to GDPR

How to use the template:

• Click on the link above to access the template

  • If you are a Google Workplace organization, make a copy by going to File > Make a copy

  • If you are not a Google Workplace organization, download a copy by going to File > Download and select your preferred file type (available as DOCX, PDF, and more)

• Review and then remove instructional text

• Save in a centralized place

• Attach to evidence either through Integrations, Automated Collection, or direct upload

Questions?

Reach out through our chat feature for real-time Customer Success support 8 am - 5 pm PT Monday through Friday.