Controllers and processors each keep one, and supervisory authorities can ask for it. Keeping it current is the hard part, because processing changes every time a product or vendor does.
The RoPA guide covers what it must contain.
Read more
Related terms
- GDPR
- The GDPR is the EU General Data Protection Regulation, which governs how personal data of people in the EU is processed and protected.
- Data protection impact assessment
- A data protection impact assessment is the GDPR Article 35 assessment a controller must carry out before processing likely to result in a high risk to people.
- Data processing agreement
- A data processing agreement is the contract GDPR Article 28 requires between a controller and a processor, setting how personal data may be handled.