Records of Processing Activities
The records of processing activities (RoPA) are the central inventory of all personal data processing. They are the basis for almost every following workshop, so this one deserves particular care.
Workshop 3 video
Walkthrough of the workshop and its tasks — coming soon
What ResGuard provides
- Records of processing (RoPA) module with a library of ready-made processing activities
- Training slides with an explanation and a practical example for every task
- Built-in fields for data, data subjects, purpose, legal basis, retention and recipients, so nothing is forgotten
- Links to departments, applications and vendors, and an Excel export for auditors
Workshop tasks
-
1. Identify processing activities
Run short interviews with each department: HR (recruitment, payroll, attendance), sales and marketing (clients, newsletters, website), finance (invoicing, collections) and IT (accounts, email, video surveillance).
In ResGuard: Data InventoryPresentation: open the slides for this task -
2. Data, data subjects & flows
For each activity, document the data categories, whether sensitive data is involved, the data subjects, the source, the recipients and the systems. Remove data that is not needed.
In ResGuard: Data InventoryPresentation: open the slides for this task -
3. Purpose & legal basis
Describe a concrete purpose and assign the matching legal basis: consent, contract, legal obligation or another exception provided by law.
In ResGuard: Data InventoryPresentation: open the slides for this task -
4. Consent management
Where processing relies on consent, document how it is obtained, how it is recorded so it can be proven, and how it can be withdrawn.
Presentation: open the slides for this task -
5. Retention & transfers
Record the retention period and transfers to other countries or within the group. They are the basis for workshops 6 and 10.
In ResGuard: Data InventoryPresentation: open the slides for this task -
6. Review & maintenance
Assign an owner to each activity, define an annual review and the triggers for updates: new systems, purposes or vendors.
Presentation: open the slides for this task -
7. Workshop review & close-out
Review the complete RoPA with the DPO, attach evidence and close the objective in ResGuard.
In ResGuard: Objective ManagerPresentation: open the slides for this task
What to keep in mind in Chile
- Law No. 21.719 introduces legal bases besides consent, for example performance of a contract, a legal obligation or the legitimate interest of the controller. Document the basis for each activity.
- Consent must be free, informed, specific and unambiguous. For sensitive data it must be explicit, and for children under 14 it is given by their parents or legal representatives.
- The law counts biometric data and socio-economic situation among sensitive data: flag them carefully in the RoPA.
Expected result
- Processing activities from all departments recorded in the RoPA
- Data, data subjects, purpose and legal basis documented per activity
- Retention periods and transfers recorded
- Owners and review cycle assigned
ResGuard modules: Data Inventory (RoPA)