A living record of processing that maps itself
Processing activities, data categories, purposes and lawful bases, controllers and processors, retention schedules and international transfers — held in one connected map instead of a spreadsheet that goes stale the day it is signed.
Records of Processing
Workspace · Records of processing
| Activity | Categories | Lawful basis | Role | Retention | Status |
|---|---|---|---|---|---|
| Payroll administration | Financial, ID | Legal obligation | Controller | 7 yrs | Complete |
| Product analytics | Behavioral | Legitimate interest | Controller | 14 mo | Review |
| Marketing consent list | Contact | Consent | Controller | Until opt-out | Complete |
| Customer support tickets | Contact, comms | Contract | Processor | 24 mo | No basis set |
| Fraud scoring | Financial, device | Legitimate interest | Controller | 5 yrs | Complete |
International transfers
Live transfer map · SCC + adequacy trackedLawful basis mix
Across 74 activities- Legitimate interest28
- Contract19
- Consent15
- Legal obligation12
Retention schedule
6 activities past review date| Activity | Rule | Next review |
|---|---|---|
| Product analytics | 14 mo rolling | Overdue 12d |
| Support tickets | 24 mo after close | Overdue 30d |
| Server access logs | 90 days | On track |
| Applicant records | 6 mo post-decision | Due Aug 20 |
Records of Processing capabilities
RoPA replaces the annual spreadsheet with a continuously maintained map. Each processing activity links to its data categories, purposes and lawful bases, the controllers and processors involved, a retention schedule and any international transfer — so an Article 30 record is a view you generate, not a document you rebuild.
Processing activity register
Every activity is a first-class record linked to its systems, teams and data flows — searchable, filterable and always current.
Data categories & subjects
Classify the personal data and data-subject groups each activity touches, including special-category flags that raise the review bar.
Purposes & lawful bases
Attach a purpose and one of six lawful bases to every activity, with gaps surfaced the moment a basis is missing.
Controllers & processors
Record the controller/processor role and the counterparties involved, linked through to the matching DPA and vendor record.
Retention schedules
Define retention rules per activity and get review prompts before data outlives its stated purpose.
International transfers
Track every cross-border flow, its transfer mechanism and destination, visualized on a live map with SCC and adequacy status.
Outcomes teams feel
Records of Processing is one module of a connected platform — the value compounds as its records link to the rest of your privacy operations.
- Always audit-readyAn Article 30 record becomes a report you export on demand, reconciled with the DPAs, vendors and assessments it depends on.
- Gaps surface earlyMissing lawful bases, stale retention and untracked transfers are flagged continuously — not discovered during an investigation.
- One connected mapBecause the record links to real systems and counterparties, it reflects how data actually moves, not how it moved a year ago.
Connected, not siloed
Records created here flow into adjacent modules automatically — a vendor here becomes a counterparty in DPA Review and an entry in your RoPA.
See Records of Processing on your own data
Book a walkthrough and we will show Records of Processing running against a workflow your team actually owns — connected to the rest of PrivacyPoint.