---
title: "Records of Processing Activities (ROPA)"
controller: "REPLACE — legal name of the controller"
controller_contact: "REPLACE — DPO email or controller contact"
last_reviewed_at: "REPLACE — YYYY-MM-DD"
review_cadence_days: 365
processing_activities: []
---

> ⚠️ **STARTER TEMPLATE — REPLACE BEFORE COMMITTING.**
> Installed on demand via `devaudit bootstrap-governance` (v0.1.36+) as a starting point.
> It does **not** describe your project's actual processing activities. Edit before committing.
> Auditors reject unedited stubs. See `docs/governance-templates.md` for guidance.

# Records of Processing Activities

**Framework coverage:** `GDPR.Art-30` (Records of processing activities)

**Evidence type:** `ropa` · **Cadence:** refresh every 365 days (portal flags as `expired` after)

## Uploading this artefact

- **File path:** `compliance/governance/ropa.md` (kept in-repo for review; CI does NOT upload it).
- **Upload trigger:** manual via the portal Upload Evidence form at `/projects/<slug>/upload` — select evidence type `ropa`. Tier-2 governance docs are operator-uploaded only since DevAudit-Installer v0.1.39 — the previous CI auto-upload was treating placeholder content as canonical evidence. The matrix MISSING row for `GDPR.Art-30` renders an `Upload ropa.md →` deep-link that pre-fills the form for you.
- **Verify after upload:** open `/projects/<slug>/compliance` on the DevAudit portal. The **GDPR Art. 30** clause should flip MISSING → COVERED immediately.
- **Refresh cadence:** annually (365 days). The portal renders an inline `Expires YYYY-MM-DD` on the clause (amber within 30 days, red once stale).

## Framework checklist — GDPR Art. 30

Before committing, confirm each item below — if any is unchecked, the document is not yet audit-ready:

- [ ] Controller's legal name + contact + DPO listed
- [ ] At least one processing activity documented (no placeholder "Activity 1" row left in)
- [ ] Each activity carries: purpose, lawful basis (Art. 6), data subject categories, data categories, recipients, retention, transfers
- [ ] Special categories (Art. 9) flagged where applicable
- [ ] Cross-border transfer mechanism named where data leaves the EEA
- [ ] `last_reviewed_at` frontmatter matches the actual review date

## Controller

- **Legal name:** REPLACE
- **Address:** REPLACE
- **Contact / DPO:** REPLACE
- **Joint controllers / representatives:** REPLACE (or "none")

## Processing activities

For each distinct processing activity your project performs, add one section below. Delete this template row before your first audit.

### Activity 1 — REPLACE (e.g. "User authentication and session management")

| Field | Value |
| --- | --- |
| **Purpose(s) of processing** | REPLACE — why you process this data; lawful basis (Art. 6) |
| **Categories of data subjects** | REPLACE — e.g. customers, employees, prospects |
| **Categories of personal data** | REPLACE — e.g. name, email, IP address, hashed password |
| **Special categories (Art. 9)** | REPLACE — none / specify (health, biometric, etc.) |
| **Recipients / categories of recipients** | REPLACE — internal teams + named processors |
| **Third-country transfers** | REPLACE — none / list countries + safeguard (SCCs, adequacy) |
| **Retention period** | REPLACE — e.g. "duration of customer relationship + 7 years" |
| **Technical and organisational security measures** | REPLACE — link to ISO 27001 controls / Test_Policy.md / encryption details |

### Activity 2 — REPLACE

(repeat the table above)

## Sources

- [ICO ROPA template (UK)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/records-of-processing/)
- [EDPB Guidelines on Article 30](https://edpb.europa.eu/our-work-tools/our-documents/guidelines/)
- Your privacy policy + DPIA (`compliance/governance/dpia.md`) should describe the same activities.

## Review log

| Date | Reviewer | Changes |
| --- | --- | --- |
| REPLACE — YYYY-MM-DD | REPLACE | Initial ROPA authored from starter template |