Records of processing activities

A comprehensive inventory documenting how an organization collects, uses, stores, and shares personal data. It details the purpose of each processing activity, the categories of data subjects involved, the recipients of the data, and the defined retention periods. This document serves as a foundational map for demonstrating accountability under data protection laws like GDPR.

In practice

During an audit, this is typically the first document requested to serve as a baseline; auditors then compare the ROPA against actual system configurations and staff interviews to ensure no "shadow" processing exists.