Record of Processing Activities (RoPA)

The RoPA is the document that every audit by the Polish DPA begins with. For each processing activity you document: the purpose and legal basis, categories of data subjects and personal data, recipients, any transfers outside the EEA, retention periods, and a general description of security measures.

A controller maintains the full record of processing activities, while a processor maintains the narrower record of categories of processing activities. There is an exemption for small organisations, but it comes with so many conditions that in practice almost everyone maintains the register.

The real challenge is not creating the RoPA but keeping it aligned with reality. A register is born looking clean and dies quietly when the marketing team rolls out a new tool and no one adds the corresponding row. That is why it is better when the register inherits context from processes and systems and updates itself automatically.