What is a RoPA (record of processing activities)?

A RoPA, or record of processing activities, is the written record that each controller must keep of its processing of personal data. It is required by Article 30 of the UK GDPR and EU GDPR.

What Article 30 requires

Article 30 says each controller maintains a record of the processing activities under its responsibility. In practice the RoPA is a register of what personal data you process and why.

A RoPA is not a one-off exercise. It needs to stay accurate as processing changes, for example when a new system, supplier or purpose is introduced.

The 250-employee exemption

Article 30(5) contains an exemption for organisations with fewer than 250 employees. It is easy to read this as "we don't need a RoPA", but the exemption does not apply where any of the following is true:

The "not occasional" limb deserves attention. If your organisation processes employee or customer data routinely, that processing is unlikely to be occasional, so the exemption may not help you. Data covered by Article 9 or Article 10 also removes the exemption. See special category data.

RoPA, DPIA and documents

A RoPA records processing at the level of activities. A DPIA looks in depth at one activity that is likely to result in a high risk. The two work together: the RoPA helps you spot which activities need a DPIA.

Both depend on knowing what personal data you actually hold. That is harder than it sounds when much of it sits inside contracts, letters, scanned forms and reports rather than in a database.

Where DOCNUS fits

DOCNUS does not create or maintain a RoPA. Its privacy assessment, on Professional and Enterprise plans, can help you check your record against reality. For each document it shows which categories of personal data were found, whether special category or criminal offence data is present, an estimate of the number of data subjects, and the pages involved. Values are shown masked.

That can reveal processing your RoPA does not mention, such as health information in a folder of supplier contracts. You can then ask questions about the library in plain English, with answers that cite the page.

The assessment is automated, not legal advice, and can miss things. Use it as an input to your RoPA, not as the RoPA. For the wider legal picture, see UK GDPR.