Regulation and data
ROPA (record of processing activities)
The ROPA, or record of processing activities, is the document art. 30 of the GDPR requires of controller and processor: what data are processed, what for, whose, who receives them, whether they leave the EU, when they are deleted and under what security measures. It goes to the supervisory authority on request.
Also known asRoPA · record of processing activities · registro de actividades de tratamiento
What it has to contain
It is the document the AEPD, the Spanish data protection authority, asks for as soon as there is a complaint, and the one that orders everything else: every supplier that appears as a recipient needs its DPA, and every deletion period is the one applied when someone exercises the rights the GDPR gives them. A published example is Bedel's ROPA. Its content is set by art. 30.1, in writing or in electronic form (art. 30.3):
- the name and contact details of the controller and, if there is one, of the data protection officer;
- the purposes of each processing operation;
- the categories of data subjects and of data: residents, families, staff; identification, health, access logs;
- the categories of recipients, those in third countries included;
- international transfers and, where applicable, their safeguards;
- where possible, the time limits for deletion and a general description of the security measures.
Worth knowing
The 250-person exemption rarely helps a centre. Art. 30.5 exempts organisations with fewer than 250 employees from the record, unless the processing is likely to pose a risk, is not occasional or includes special categories. A residence processes its residents' data every day, and if it has a dining hall it processes allergies, which are health data. The processor also keeps its own, covering what it processes on behalf of each controller (art. 30.2), and art. 31 of the LOPDGDD confirms it in Spain.
Sources
Related terms
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- DPA (data processing agreement)A DPA (data processing agreement) is the contract that art. 28.3 of the GDPR requires between the controller and each processor: it sets out the subject matter, duration, nature and purpose of the processing, the type of data and of data subjects, and each party's obligations and rights.