Records of Processing Activities

Definitions #

A document required under GDPR Article 30 that lists what personal data a company processes, why, where, and how long it keeps it.

Technical A mandatory register maintained by controllers and processors to demonstrate accountability, including categories of data subjects, recipients, international transfers, and retention periods.

Example The DPO updated the Record of Processing Activities to include the new marketing analytics tool.

Etymology #

From Latin recordari (to remember) + processing (from Latin processus) + activities (from Latin activus); the term is standard GDPR terminology.

Collocations #

Article 30 Records GDPR 第 30 条要求的处理活动记录
maintain a ROPA 持续更新和维护处理活动记录
retention period 数据保留期限，记录中必须列明

Real Business Examples #

The controller must keep a record of processing activities that includes the purposes of the processing.
Our ROPA reveals several cross-border transfers we need to document with SCCs.

Register & Variants #

Register: formal
BrE/AmE: 主要欧洲语境，全球通用合规

Synonyms & Antonyms #

Synonyms: processing register, data processing record

Common Errors #

认为 ROPA 只有大型公司需要 GDPR 要求 250 人以上的处理者或特定情况下的其他组织，小企业也可能需要
把 ROPA 当作一次性文档它必须持续更新，反映当前的处理活动

Confusable Terms #

Data Protection Impact Assessment (DPIA) vs Records of Processing Activities: DPIA 是评估高风险处理的风险工具，ROPA 是处理活动的登记记录
Privacy Policy vs Records of Processing Activities: 是外部告知用户的信息文件，ROPA 是内部合规清单

Frequently Asked Questions

我需要保存多久？?

只要处理活动继续，就必须保存并更新；监管机构可能要求随时提供

可以包含哪些栏目？?

至少包括处理目的、数据类别、接收方、跨境转移、保留期限

Published: 2026-09-24 Category: Data Protection