Record of processing activities (RoPA)
The record of processing activities (RoPA) is the written, including electronic, inventory that each controller and, where applicable, its EU representative must maintain under Art. 30(1) GDPR, and that each processor must maintain for the processing carried out on behalf of its controllers under Art. 30(2). It must be made available to the supervisory authority on request and is usually the first document requested in an investigation.
The controller's record must contain, for each processing activity: the name and contact details of the controller, any joint controller, representative and DPO; the purposes; the categories of data subjects and of personal data; the categories of recipients, including those in third countries; any international transfers and their safeguards; the envisaged retention periods; and a general description of the security measures. Processors record their controllers, categories of processing, transfers and security measures. The exemption in Art. 30(5) for organisations with fewer than 250 employees does not apply where processing is not occasional or involves special category data, so virtually every life sciences company must keep one.
A useful RoPA for a sponsor or HealthTech company is organised by purpose (clinical trial conduct, pharmacovigilance, medical information, HR, marketing, platform operation), links each activity to its legal basis, processor contracts and DPIA, and is reviewed at each new study, vendor or system. iliomad maintains RoPAs as part of its outsourced DPO and DPR mandates.
