// record-of-processing-activities
Record of Processing Activities (ROPA)
Record of Processing Activities
Controller: [Business name].
Contact: [contact].
Activities
[one activity per line: purpose — lawful basis — retention]
For each activity, also record
Categories of individuals and data; recipients; any transfers abroad; security measures.
Categories of data subjects (for example customers, prospects, employees, suppliers) and the categories of personal data held about them (for example contact details, order history, payment details).
The categories of recipients the data is disclosed to, including any processors acting on your behalf, and any transfers of personal data to a country outside the UK together with the safeguard relied on for that transfer.
The retention period, or the criteria used to set it, for each category of data, and a general description of the technical and organisational security measures in place (for example access controls, encryption, staff training, and backups). [Complete these details for each activity listed above.]
draft generated by privacyready — Sample content — review with a qualified person. Not legal advice.