PRACTICE NOTE
What is a ROPA?
The record of processing activities (ROPA) is a record of an organisation’s processing activities involving personal data, which your organisation must make available upon request of the Information Commissioner’s Office (ICO) or to a supervisory authority in any EU Member State via your EU Representative.
Article 4 of the United Kingdom General Data Protection Regulation (‘UK GDPR’) defines ‘processing’ as ‘’any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction’’.