The Record of Processing Activities involving personal data (RoPA) is a requirement of Article 37 of the LGPD (Brazilian General Data Protection Law). It works as a detailed inventory of all processing activities carried out by the organization.
What Is the RoPA
The RoPA, short for Record of Processing Activities, is a document that describes all personal data processing operations carried out by a company. It must contain information such as:
- Purpose of the processing
- Legal basis used
- Categories of data processed
- Categories of data subjects
- Sharing with third parties
- International data transfers
- Retention periods
- Security measures applied
Why the RoPA Is Mandatory
Article 37 of the LGPD provides that controllers and processors must keep a record of their processing operations. This record must be presented to the ANPD (Brazilian Data Protection Authority) upon request and serves as the basis for:
- Demonstrating compliance (accountability)
- Identifying and mitigating privacy risks
- Preparing the DPIA (Data Protection Impact Assessment)
- Responding to data subject requests
- Facilitating internal and external audits
How to Prepare the RoPA in Practice
Preparing the RoPA involves multidisciplinary work that combines legal, technical and operational knowledge:
Step 1: Process Mapping
Identify all business processes that involve personal data. Involve the managers of each department to ensure complete coverage.
Step 2: Data Classification
For each process, classify the data processed (personal data, sensitive data, data of minors) and identify the applicable legal basis.
Step 3: Structured Documentation
Use a tool or platform that makes it possible to document, version and update the RoPA in a centralized way.
Common Mistakes When Preparing the RoPA
- Superficial mapping: Not involving all of the company's departments
- Lack of updates: The RoPA is a living document that must reflect current reality
- Incorrect legal basis: Relying on consent when another basis would be more appropriate
- Missing retention periods: Not defining clear retention periods