thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Records of Processing Activities (ROPA)

GDPR Article 30 documentation of a controller's or processor's processing operations.

Definition

Controllers must record purposes, categories of data subjects and data, recipients, international transfers, retention periods, and security measures. Processors keep a record of processing carried out on behalf of controllers. Organizations with fewer than 250 employees are exempt unless processing is risky, not occasional, or involves special categories. Supervisory authorities can request the records.

Example

A ROPA entry documents the CRM processing: purpose marketing, categories contact data, retention 3 years.

Exam tip

A data inventory or map is the practical foundation for the ROPA.

Related terms