Records of Processing Activities
The records of processing activities (RoPA) are the central inventory of all personal data processing. They are the basis for almost every following workshop, so this one deserves particular care.
Workshop 3 video
Walkthrough of the workshop and its tasks — coming soon
Workshop tasks
-
1. Identify processing activities
Run short interviews with each department: HR (recruitment, payroll, attendance), sales and marketing (clients, newsletters, website), finance (invoicing, collections) and IT (accounts, email, video surveillance).
In ResGuard: Data Inventory -
2. Data, data subjects & flows
For each activity, document the data categories, whether sensitive data is involved, the data subjects, the source, the recipients and the systems. Remove data that is not needed.
In ResGuard: Data Inventory -
3. Purpose & legal basis
Describe a concrete purpose and assign the matching legal basis: consent, contract, legal obligation or another exception provided by law.
In ResGuard: Data Inventory -
4. Consent management
Where processing relies on consent, document how it is obtained, how it is recorded so it can be proven, and how it can be withdrawn.
-
5. Retention & transfers
Record the retention period and transfers to other countries or within the group. They are the basis for workshops 6 and 10.
In ResGuard: Data Inventory -
6. Review & maintenance
Assign an owner to each activity, define an annual review and the triggers for updates: new systems, purposes or vendors.
-
7. Workshop review & close-out
Review the complete RoPA with the DPO, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind in Peru
- In Peru, personal databases are registered with the National Register for Personal Data Protection. Use the RoPA to identify which databases you need to register or update.
- Consent must be free, prior, express, informed and unequivocal. For sensitive data the law also requires it to be in writing.
- Document cross-border data flows; they are reviewed in detail in Workshop 10.
Expected result
- Processing activities from all departments recorded in the RoPA
- Data, data subjects, purpose and legal basis documented per activity
- Retention periods and transfers recorded
- Owners and review cycle assigned
ResGuard modules: Data Inventory (RoPA)