This video explains how to create a new Record of Processing Activity (RoPA) within a processing area and work through its assessment form.
From the left-hand menu, click Data Privacy and Protection, then Records of Processing.
Select the Record of Processing Area where you want to create the activity, then click New Process.
Enter the title and purpose of your processing activity, then click Save & Add Details.
Work through the four steps shown at the top: Processing Overview, Processing Description, Processing Risk and Processing Review.
Note: If you have unsaved changes, use the buttons at the bottom of the screen to move forward.
The activity title and a reference number starting with RoPA appear at the top; the number is generated automatically and cannot be changed.
Record third parties, such as software vendors or suppliers. Link a vendor using the quick actions menu in the Vendor Assessment log; details then appear in both the vendor log and the activity form.
Complete the Processing Risk Assessment on Step 3. As a general guide:
More than two risks – consider a Data Protection Impact Assessment.
More than four risks – start DPIA screening straight away.
Processing involving vulnerable groups, such as children – a DPIA is strongly recommended.
Tip: Tooltips offer guidance, and high-risk items are flagged automatically.
Link a DPIA either by selecting the Processing Activity in DPIA screening, or by clicking Save & Begin DPIA on Step 4.
Note: Answers to duplicate questions are synced automatically.
Select data subjects with their personal data and special category data; choices appear as pills, and the Answered pill shows how many subjects you've selected.
Click + New in the top-right corner to create a Risk, Issue, Lesson or Task; these are logged in the Summary of Activities table on Step 4.