What is a ROPA?
A Record of Processing Activities (ROPA) is a mandate under the General Data Protection Regulation (GDPR) for certain organizations to maintain an inventory of their data processing activities, serving as evidence of GDPR compliance and a tool to identify and mitigate data protection risks.
Article 30 of the GDPR requires certain businesses to create and maintain a comprehensive overview of their personal data processing activities, which must be made available to a supervisory authority when asked. Businesses that fall under the applicable criteria include those which regularly engage in data processing activities, those whose operations may impact the rights and freedoms of data subjects, or those that handle special categories of personal data such as race, gender, sexuality, religion, and others.
Similar requirements are upheld by other jurisdictions’ privacy regulations as well.
A comprehensive ROPA should include the organization’s details, processing activities, purposes of data processing, descriptions of the categories of individuals about whom personal information is processed and what types of personal information is processed, recipients of personal data, data transfers to third countries, proposed time limits for data retention, and a general outline of security measures.
An example ROPA
Why do we call Relyance’s ROPA ‘Universal’?
Relyance’s Universal ROPA™ is truly “universal” because it is designed to be automatically generated to materially conform to the published requirements across all global data protection authorities and is continuously updated.
How do you prepare a ROPA?
There are a few key steps to prepare your ROPA manually:
- Identify all data processing activities.
- Understand and document key processing activity details. Youʼll want to include, at a minimum, the purpose, data categories, data subjects, data recipients, data transfers, retention period, and security measures involved.
- Regularly update your ROPA.
How does Relyance help with preparing your ROPA?
Given the nature of Relyanceʼs continuous compliance management and monitoring technologies, customers will always have an auto-generated up to date ROPA on file. This can be seen in each business entity, product, service, vendor, or partner ROPA but also in the Universal ROPA moduleʼs pivotable spreadsheet-type view.
Identify all data processing activities
Relyance plays a crucial role in identifying and understanding all the activities associated with data processing. It is imperative to develop a comprehensive data map, because doing so enables you to gain a holistic view of the data ecosystem and its various components.
We derive the processing activities from both vendors and partners.You can also add processing activities to any internal products or business entities (see Business Atlas). To delve deeper into this subject, you can refer to our processing activity taxonomy here. This taxonomy provides a structured framework to classify and organize the different data processing activities efficiently.
Relyance employs the following methods to identify all data processing activities:
- Vendors are regularly detected via the four methods of integration ( Infrastructure, Source Code, Contracts, and Vendor integrations).
- ROPA fields are automatically detected in a number of ways:
- Machine learning (“ML”) - ROPA fields are detected by vendor detection and/or processing activity mapping.
- Relyance maintains backend tables linking processing activities to all vendors.
- Contract integration - ROPA fields are derived from contracts/DPAs. Relyance only scans relevant DPAs/MSAs in PDF format. Please see the following article
Understanding the Types of Contracts Ingested by Relyance
.
Understand and document key processing activity details
Each processing activity should have the following documented:
| Purpose | Why is this data being processed? |
|---|---|
| Data categories | What types of data is being processed? |
| Data subjects | Whose data are you processing? |
| Data recipients | Who else has access to the data? |
| Data transfers | Is this data being transferred to other countries or organizations? |
| Retention period | How long is this data retained? |
| Security measures | What security measures are in place to protect the data? |
Relyance’s Machine Learning (ML) models and Natural Language Processing (NLP) features help identify these relevant ROPA fields and automatically update your ROPAs where needed.
Intelligent insights help identify areas in your privacy and data protection program that may need updating or review.
Regularly update your ROPA
Integration, source code, and contract scans are typically scheduled to run daily. This aligns with the 'shift-left' approach, which helps promptly identify any vendors or data types that may be present in your operational and contractual landscapes.
Should a change occur, Relyance can be configured to send an email notification to subscribed parties.
This ensures your ROPA is regularly updated and the continuous monitoring of these systems.