Record of Processing Activities (RoPA)

The Record of Processing Activities (RoPA) is required by Article 30 GDPR. It is an inventory of every activity in which the company processes personal data: payroll, customers, CCTV, marketing, recruitment…

For each activity it states: the controller and contact details, the purpose, categories of individuals and data, recipients, transfers outside the European Economic Area, erasure time limits and a description of security measures.

There is an exemption for organisations with fewer than 250 employees, but it is very narrow: it does not apply if processing is not occasional, includes sensitive data or may pose a risk. In practice almost every company needs one. It is also a good starting point for an AI inventory: every AI system that processes personal data should appear in it.