Article 30 Compliance
Records of Processing Activities (ROPA)
The EU’s General Data Protection Regulation (GDPR) requires covered entities to maintain what is known as a “Record of Processing Activities” (ROPA). This record should reflect the business’ complete inventory of its data processing, along with a detailed description of how personal data is being handled. From a practical standpoint, the creation and maintenance of a dynamic ROPA helps businesses remain regulatory compliant, thus avoiding sanctions, fines, or penalties that might otherwise be imposed under the GDPR.
The bottom line
First comes discovery, then comes classification.
You must know your assets before you can properly protect your data.
What information does Article 30 require?
By mandate, the GDPR’s Article 30 requires a “data controller” to “maintain” a ROPA that identifies the following elements:
- The name and contact details for the enterprise’s Data Protection Officer (DPO)
- The purpose for processing any personal data, i.e., why is the personal data being used/collected
- Category of the data subject: consumer, employee, contractor, etc.
- Categories of the personal data being processed: contact information, financial, health related, etc.
- The categories of data subjects and personal data collected
- Data outflows: is the data being shared
- Data outflows outside of the EU/EEA/UK
- Data retention schedules
- Description of both processes and procedures: human, or technological for securing and/or safeguarding the data, and
- The lawful rationale (legal basis under Art. 6) and legitimate interests for personal data collection.
We take the hassle out of Article 30 compliance.
Our Data Protection Officers (“DPO”) have extensive experience building and maintaining ROPAs for businesses of all sizes and industries. Along with our deep experience, we partner with Securiti.ai, providing our clients with the most advanced ROPA technology in the industry. We have the necessary people, processes, and technology to ensure our clients remain compliant with all Article 30 requirements.
Not sure where to begin, or even if a ROPA is right for you?
We understand that creation and maintenance of a ROPA, even for the smallest enterprise, is a significant undertaking. However, as data privacy laws like GDPR and CCPA/CPRA develop and morph, building a ROPA can aid in overall risk-mitigation – even for organizations not currently inside the GDPR’s regulatory umbrella. ROPA insights are critical for any company that collects or processes personal data.
Contact the team at Advisori today. We can get this process underway and give you the tools you need to maintain compliance.