Glossary · Privacy and data protection
A RoPA is the ledger a privacy regulator asks to see first.
A written inventory, required by GDPR Article 30, of each personal data processing activity: its purpose, the people and data involved, recipients, transfers and retention.
Back to the glossary01 · In plain words
In plain words
A written inventory, required by GDPR Article 30, of each personal data processing activity: its purpose, the people and data involved, recipients, transfers and retention.
Every organisation that handles personal data does many separate things with it: payroll, marketing, support, analytics. A RoPA writes each of those down as one line, with why it happens, whose data it touches, who receives it and how long it is kept. Under the General Data Protection Regulation (GDPR), keeping this record is a legal duty, not a nice-to-have.
Spelled out: Record of Processing Activities.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
A supervisory authority can ask for the record at any time, and it is often the first document requested after a complaint or a breach. It is also the base every other privacy task stands on. You cannot answer an access request, judge whether a data protection impact assessment is needed, or check a vendor contract if you do not know where the data flows. A controller and a processor keep different versions: the controller records purposes and recipients, while the processor records which clients it acts for and what it does on each one's behalf. Organisations under 250 people get a partial exemption, but it falls away when the processing is regular, risky, or involves special category or criminal-offence data, which catches most real businesses.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- GDPR Article 30
- Paragraph 1 lists the controller's fields; paragraph 2 lists the processor's; paragraph 5 sets the 250-person exemption and its limits.
- A supervisory authority request
- The record must be in writing, electronic is fine, and handed over when the authority asks.
- A customer's vendor questionnaire
- Enterprise buyers ask a processor to show its record for the services it runs for them.
- The DPIA and transfer files
- Each risky line in the record should point to its impact assessment and, for transfers, the safeguard relied on.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a payroll platform in Pune with German clients
A payroll software company in Pune processes salary data for twelve German employers. It acts as a processor, so its record lists each client as a controller, the categories of processing done for each (payslip generation, tax filing exports, support access), the sub-processors used, the fact that data is hosted outside the EU and the safeguard relied on, and a general description of its security measures. When one client's auditor asks for the record, the company sends that client's extract within a day instead of rebuilding it from emails. The same record also showed the team that a support tool kept tickets forever, which they then fixed.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Data map
- A data map traces systems and flows, often as a diagram. The RoPA is the formal record organised by processing activity. One usually feeds the other.
- Privacy notice
- The notice tells people what you do with their data. The RoPA is an internal record you show a regulator, not the public.
- DPIA
- A DPIA studies one high-risk activity in depth. The RoPA lists every activity in brief and flags which ones need a DPIA.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- List processing activities by business purpose, not by system, then attach the systems to each one.
- Decide for each line whether you act as controller or processor, and keep the two records separate.
- Give each line an owner and a review date, and update it whenever a new vendor or feature goes live.
- If you also serve Indian users, reuse the same inventory for your DPDP work rather than building a second one.
- GuideData mapping and the processing recordThe inventory every other DPDP task depends on.
- GuideControllers, processors & DPOsWho decides, who processes, and when a DPO is required.
- GuideGDPR and India's DPDP ActData fiduciaries, consent, rights and penalties, side by side with GDPR.
Sources: Regulation (EU) 2016/679 (General Data Protection Regulation), Article 30 and Recital 82; the Digital Personal Data Protection Act, 2023; the Digital Personal Data Protection Rules, 2025.
Questions about RoPA
Does India's DPDP Act require a RoPA?
Not in those words.
The Digital Personal Data Protection Act, 2023 has no section that mirrors GDPR Article 30, and we have not found a general duty to keep a record of processing in the Act or the Rules. In practice you still need the same inventory to give notices, honour rights, meet retention limits and show reasonable security, so most teams keep one anyway. Counsel should confirm how the law applies to your own position.
We have fewer than 250 staff. Are we exempt?
Rarely in full.
The exemption does not apply when processing is not occasional, is likely to result in a risk to people's rights, or includes special category or criminal-offence data. Payroll and customer databases are not occasional, so most small companies still keep a record for at least those activities.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.