Know your data

What it’s for

A Record of Processing Activities (RoPA) lists every way your business uses personal data: what, why, on what lawful ground, who else touches it, where it goes and how long you keep it. One row covers one processing activity.

What you fill in

1. 1

   RoPA workbook

   Three tabs: Instructions, RoPA and Dashboard. One row covers one processing activity, and a worked example row is included and never counted.

2. 2

   RoPA tab

   Twenty columns that record what you process and why, whose data it is, who else handles it, where it goes, how long you keep it and how you protect it. Legal Basis is a dropdown: consent, or one of the legitimate uses the Act lists.

3. 3

   Dashboard tab

   Counts your activities and shows how many are high risk, need a DPIA, involve children's data or send data abroad.

From the video

Two frames from the walkthrough. The worked example is a fictional online store.

Basis Act s.4(1), s.6, s.7(a) to (i); Act s.9(1). How we arrived here