What a ROPA is for
A record of processing activities documents how your organisation uses personal data. The GDPR requires one in Article 30, and African laws rely on the same information for registration with the regulator and for showing accountability. When a regulator asks what you do with personal data, the ROPA is the answer.
The columns to include
| Column | Example |
|---|---|
| Processing activity | Payroll |
| Purpose | Paying staff and meeting tax obligations |
| Lawful basis | Contract; legal obligation |
| Data subjects | Employees |
| Personal data | Name, ID number, bank details, salary, tax PIN |
| Sensitive data | None, or health data for sick leave |
| Systems | HR system, payroll software |
| Recipients | Bank, tax authority, pension provider |
| Transfers abroad | Payroll software hosted in Ireland |
| Retention | Seven years after employment ends |
| Owner | Head of HR |
Download the free ROPA starter template: a CSV with every column, ready to fill in or import into hlola.
Building it in five steps
- List your teams, and for each one the activities that involve personal data
- Interview each team owner with the columns above; start with HR, finance, sales, marketing and customer service
- Link each activity to the systems and vendors that hold the data
- Check each activity for gaps: no lawful basis, no retention period, a transfer without safeguards
- Assign an owner to review each activity at least yearly, and whenever the processing changes
Keeping it current
A spreadsheet ROPA goes out of date the week after it is finished. In hlola the ROPA is a view of the data map: systems, vendors and activities recorded once and linked, so a change to a vendor updates every activity that uses it, and sensitive data or foreign hosting raises the DPIA or transfer assessment automatically. See ROPA in hlola.
Common questions
What is a ROPA?
A record of processing activities: a register of how an organisation uses personal data, including purposes, lawful bases, data subjects, recipients, transfers and retention.
Is a ROPA required in Africa?
The GDPR requires one under Article 30, and African laws rely on the same information for registration and accountability, so in practice every organisation needs one.
Is there a free ROPA template?
Yes. hlola's ROPA starter template is a free CSV with every column needed, and it imports directly into hlola.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.