Creating the RoPA: how the record becomes a steering instrument

Cut activities along stable purposes

Entries that are too coarse, such as “HR”, hide different purposes and legal bases. Entries that are too fine-grained, at the level of screens or tables, are barely maintainable. A workable cut describes a purpose the business understands, with stable data flows.

Upkeep comes from connections to your processes

The record stays current when new applications, service providers, projects and changes automatically trigger a data protection review. An annual round of calls alone often discovers relevant changes too late.

• business purpose and responsible role
• categories of data subjects and data
• recipients, third-country relevance and processors
• deletion logic, technical and organisational measures, risks and last review