What Is This Module For?
The ROPA (Record of Processing Activities) module provides a centralised register of all personal data processing activities in your organisation — the foundation of your data protection programme.
Which Law Requires This?
- DPDP Act 2023, Sections 5 and 8 — Data Fiduciaries must process personal data only for specified, clear, and lawful purposes, and maintain accountability for all processing activities.
- DPDP Rules 2025, Rules 5–6 — Processing must be documented with purpose, legal basis, data categories, and retention periods.
Step-by-Step Guide
- Go to Processing Activities (ROPA) in the sidebar.
- Click "Add Processing Activity" for each category of personal data you process.
- For each activity, enter: purpose of processing, legal basis (consent / legitimate use / legal obligation), categories of data, categories of data subjects, recipients, cross-border transfers (if any), and retention period.
- Link to your DPIAs, consent records, and data retention policies.
- Export your ROPA as a PDF or CSV for regulatory submissions or audits.
Common Mistakes to Avoid
- One entry for all processing — Each distinct processing purpose needs a separate ROPA entry.
- Not updating the ROPA when processes change — The ROPA must be a living document. Update it whenever you change how you process data.
Frequently Asked Questions
Q: Who needs a ROPA?
A: Every Data Fiduciary under the DPDP Act — any organisation that collects or processes personal data of Indian citizens.
Q: How often should the ROPA be reviewed?
A: At least annually and whenever you introduce a new processing activity or significantly change an existing one.