ROPA stands for record of processing activities, and it is the register a business keeps of what personal data it processes, why, who receives it and how long it is kept. It is an internal document: nobody publishes theirs. It is also the document every other privacy obligation quietly depends on, which is why a company that has one answers access requests in hours and a company that does not answers them in weeks.
What the register has to hold
Article 30 of the GDPR sets the columns: who you are and who your data protection contact is, the purposes of the processing, the categories of people and the categories of data, the categories of recipient including anyone outside the region, the transfers you make and the safeguards for them, the retention periods where you can state them, and a general description of your security measures. Written down plainly, that is eight columns and one row per activity, and most small companies have between ten and thirty rows.
The exemption that almost never applies
The obligation is relaxed for organizations with fewer than 250 employees, which reads like an exemption and is not one. It falls away if the processing is likely to risk people's rights, if it is not occasional, or if it includes special category data. Routine processing of customer and employee records is not occasional by any reading, so the practical position for a company that runs a website, a mailing list and a payroll is that the register is owed.
It is the same work as the data map
A record of processing activities and a data map are the same exercise in two vocabularies. The map answers where the data is; the register answers what you do with it and why. Building either one produces most of the other, and both produce the list your published privacy notice needs, the recipient list an access request needs, and the vendor list your processing agreements need. Doing it once and keeping it current is the single highest-return piece of privacy work a small company can do.
Keeping it true
A register written once and filed is worse than none, because it creates a document that contradicts your actual processing. Tie the update to the events that change it: a new tool that receives personal data, a new purpose for data you already hold, a vendor that changes sub-processors, a retention decision. A quarterly review of the tool list catches nearly everything, and the review date belongs in the register beside the rows.
Questions people ask about ropa privacy
Does a US company with no EU office need one?
If you offer goods or services to people in the EU or monitor their behavior, the regulation reaches you, and the register comes with it. If you do not, no European rule requires one, but the same register is what makes California's disclosure duties answerable.
Is a spreadsheet enough?
Yes. The obligation is to keep the record in writing, including electronic form, and a spreadsheet with the eight columns satisfies it. Tooling helps when the number of systems is large enough that nobody can hold it in their head.
Who has to see it?
It is made available to the supervisory authority on request. It is not published and it is not sent to customers, although the parts of it describing purposes and recipients are the source of what your public privacy notice says.
How is it different from a DPIA?
The register lists everything you do. An impact assessment is a deeper look at one activity that is likely to be high risk. The register is what tells you which activity deserves one.