Privacy Register

This is the help text the console shows in the help panel on this page.

Records of Processing Activities (RoPA) per GDPR Article 30. Each record documents one processing activity and its lawful basis. Privacy is available on The Scale plan; Owners and Managers can create and change records, Members can view them.

Why This Matters

Article 30 of the GDPR requires controllers and processors with 250 or more employees, or those whose processing is likely to result in a risk to individuals, to maintain written records of processing activities.

The List

• Columns: Name, Purpose, Lawful Basis, Status (Draft, Active, Retired), DPIA and Created.
• Filters: Lawful basis, Status and Requires DPIA.
• Lawful bases: Consent, Contract, Legal Obligation, Vital Interests, Public Task, Legitimate Interests.

Creating a Record

Click New Activity and fill in Name, Purpose, Lawful Basis and Role (Controller, Processor or Joint Controller). Click a row to open the record, with tabs Overview, Linked Systems, Risks & Evidence, DPIA and History.

DPIA

Records flagged DPIA required need a Data Protection Impact Assessment. On an Active record, Owners and Managers can click Run DPIA to start one.

Status

Records move Draft → Active → Retired. Retired records are kept for audit purposes. Activating, retiring and PDF export of a record are available through the API; the console shows the status.