Task 6 — RoPA Review & Maintenance
A RoPA that is out of date is worse than none — it gives false confidence.
The records are only useful if they stay current. Give every processing activity an owner, a review cycle and clear triggers for updates.
- Owner: one responsible person per processing activity, usually the process owner
- Review cycle: e.g. once a year, owners confirm or update their entries
- Update triggers: new systems, new purposes, new vendors or organisational changes
- DPO review: review the completed RoPA together with the DPO before closing the workshop
- Trigger: marketing wants to use a new webinar tool for customer events
- RoPA: the owner of "Events" adds the tool as system and recipient, and checks whether data leaves the country
- Vendor: the tool provider is assessed and a processing contract is signed (Workshop 10)
- Notice: the privacy notice for event participants is updated (Workshop 4)
- Tip: make "RoPA updated?" a question in your IT and purchasing approval process