Article 30 of the GDPR requires organizations to maintain a record of all processing activities carried out under their responsibility. LowerPlane’s ROPA module provides a structured way to create, manage, and export these records.

​
What Is a ROPA

A Record of Processing Activities is a comprehensive register that documents every way your organization processes personal data. It must include:
  • The name and contact details of the controller (your organization)
  • The purposes of each processing activity
  • The categories of data subjects and personal data
  • The categories of recipients
  • International data transfers (if applicable)
  • Retention periods for each category of data
  • A description of technical and organizational security measures
ROPA maintenance is mandatory for organizations with 250 or more employees, or for any organization that processes data that is likely to result in risk to the rights of data subjects, involves special categories of data, or relates to criminal convictions. In practice, most organizations pursuing GDPR compliance should maintain a ROPA.

​
Creating a Processing Activity Record

1

Navigate to GDPR > ROPA

Open the ROPA section from the GDPR module in the sidebar.
2

Click Add Processing Activity

Start a new record for a specific data processing activity.
3

Enter the processing details

Complete the required fields as described in the section below.
4

Save the record

Click Save to add the processing activity to your register. You can edit it at any time.

​
Required Fields

Each ROPA entry requires the following information: GDPR recognizes six legal bases for processing personal data. Select the applicable basis for each processing activity:
The data subject has given clear consent for processing their personal data for a specific purpose. Consent must be freely given, specific, informed, and unambiguous.
Processing is necessary for the performance of a contract with the data subject or to take steps at their request before entering into a contract.
Processing is necessary to comply with a legal obligation to which the controller is subject (e.g., tax reporting, employment law).
Processing is necessary to protect the vital interests of the data subject or another person. This basis is rarely applicable in business contexts.
Processing is necessary for a task carried out in the public interest or in the exercise of official authority. Primarily applies to public sector organizations.
Processing is necessary for the legitimate interests of the controller or a third party, unless overridden by the data subject’s rights. Requires a Legitimate Interest Assessment (LIA).

​
Managing Your ROPA

​
Reviewing Records

Review your ROPA entries periodically (recommended: quarterly) to ensure they remain accurate. Key triggers for review:
  • New products or services that process personal data
  • Changes to data processing vendors or subprocessors
  • Changes to retention policies
  • New international data transfers
  • Organizational restructuring

​
Editing Records

Click on any ROPA entry to view and edit its details. All changes are versioned, so you can see the history of modifications for audit purposes.

​
Exporting the ROPA

Export your complete ROPA as a PDF or spreadsheet for:
  • Supervisory authority requests
  • Audit evidence packages
  • Internal governance reporting
  • DPO review and sign-off
Start your ROPA by documenting your five to ten most significant processing activities (e.g., customer data, employee data, marketing data). Then expand to cover all processing activities over time.

​
ROPA as Compliance Evidence

Your ROPA serves as direct evidence for several GDPR controls:
A supervisory authority can request your ROPA at any time. Ensure it is always up to date and export-ready. An incomplete or outdated ROPA is one of the most common GDPR compliance findings.