Record of Processing Activity

[Bankesy]

Good afternoon all,

 

Does anybody have experience with keeping a RoPA, please? I have been presented with a template and seek some advice on how to best fill it out.

 

Thanks in advance

[enjay]

This is what ours looks like.

 

 

[Bankesy]

Thanks @enjay

Much simpler looking than what I have been given.

[AlanM]

In case it helps...

 

The UK GDPR states what a ROPA needs to have in it.

https://www.legislation.gov.uk/eur/2016/679/article/30

 

The ICO makes a distinction between ROPA requirements and ROPA good practice.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/accountability-framework/records-of-processing-and-lawful-basis/#Good-practice

 

You may wish to consider what information beyond the statutory items would be useful to you e.g. you could have a risk rating where items containing child and/or special category data are considered high risk and therefore require extra care.