Beyond Compliance: Keeping Your Record of Processing Activities Accurate and Useful
A Record of Processing Activities (ROPA) should be more than the written record required by Article 30 of the General Data Protection Regulation (GDPR). Done well, it is the authoritative map of how an organisation uses personal data. For a controller, it records why personal data is used, whose data and which categories are involved, […]