Record of Processing Activities (RoPA)
Also known as: RoPA, Records of Processing Activities, Data map
A Record of Processing Activities (RoPA) is a documented inventory of how an organisation collects, uses, shares and stores personal data. It is a requirement under UK GDPR Article 30 and forms the foundation of a care provider’s data-protection compliance.
A Record of Processing Activities (RoPA) is a structured record of all the ways an organisation processes personal data. Under Article 30 of the UK GDPR most organisations must maintain one, and for care providers — who handle large volumes of special-category health data — it is a core part of demonstrating accountability to the Information Commissioner’s Office (ICO) and within the DSPT.
What a RoPA must contain
For each processing activity, a RoPA typically records the purpose of processing, the categories of individuals and personal data involved, the lawful basis, who the data is shared with (recipients), any transfers outside the UK, retention periods, and the technical and organisational security measures in place.
- Purpose of the processing (for example, delivering care, payroll, safeguarding).
- Categories of people (residents, service users, staff) and data (including special-category health data).
- Lawful basis under UK GDPR, and the additional condition for special-category data.
- Recipients the data is shared with, and any international transfers.
- Retention periods and the security measures protecting the data.
Why care providers need one
A RoPA underpins other data-protection duties: it is the evidence base for privacy notices, data-protection impact assessments, subject access requests and the DSPT. Keeping it accurate and up to date demonstrates the accountability principle and helps a provider respond quickly and correctly to a data incident.
Frequently asked questions
What is a Record of Processing Activities?
A RoPA is a documented inventory of how an organisation collects, uses, shares and stores personal data. It is required under Article 30 of the UK GDPR.
Do care providers legally need a RoPA?
Yes. Because care providers process special-category health data, they are expected to maintain a RoPA under UK GDPR Article 30, and it supports both ICO accountability and the DSPT.
Related guides
Sources
- ICO — Documentation and records of processing activities
- UK GDPR Article 30
Evidence this standard with MyCareAudit
Digital audits, action tracking and inspection-ready reports that help you demonstrate record of processing activities (ropa) and every other CQC and Ofsted expectation.