# Privacy Register
URL: https://docs.autociso.io/console/privacy/register/
Description: Records of Processing Activities (RoPA) per GDPR Article 30. Each record documents one processing activity and its lawful basis.

*This is the help text the console shows in the help panel on this page.*

Records of Processing Activities (RoPA) per GDPR Article 30. Each record documents one [processing activity and its lawful basis](https://docs.autociso.io/product/privacy/data-dictionary/). Privacy is available on [The Scale plan](https://docs.autociso.io/getting-started/plans-and-features/); [Owners and Managers](https://docs.autociso.io/getting-started/roles-and-permissions/) can create and change records, Members can view them.

### Why This Matters
Article 30 of the GDPR requires controllers and processors with 250 or more employees, or those whose processing is likely to result in a risk to individuals, to maintain written records of processing activities.

### The List
- **Columns**: Name, Purpose, Lawful Basis, Status (Draft, Active, Retired), DPIA and Created.
- **Filters**: Lawful basis, Status and Requires DPIA.
- **Lawful bases**: Consent, Contract, Legal Obligation, Vital Interests, Public Task, Legitimate Interests.

### Creating a Record
Click **New Activity** and fill in Name, Purpose, Lawful Basis and Role (Controller, Processor or Joint Controller). Click a row to open the record, with tabs Overview, Linked Systems, Risks & Evidence, DPIA and History.

### DPIA
Records flagged **DPIA required** need a [Data Protection Impact Assessment](https://docs.autociso.io/console/privacy/dpia/). On an Active record, Owners and Managers can click **Run DPIA** to start one.

### Status
Records move Draft → Active → Retired. Retired records are kept for audit purposes. Activating, retiring and PDF export of a record are available through the API; the console shows the status.