RoPA: Record of Processing Activities
A RoPA that points to the real tables — not a disconnected spreadsheet.
Framework / standard: GDPR Art. 30 · Art. 6 · Art. 9
The supervisory authority requests the Record of Processing Activities (Art. 30 GDPR). The problem with a classic RoPA is not having one: it is that it lives in a privacy tool disconnected from where the data actually is. As soon as the landscape changes, the RoPA becomes inaccurate.
In Linedat, the RoPA is a hub connected to the real catalogue: each processing activity links to the assets that materialise it, to the recipients and to the DPIAs.
Tied to the real data, not an outdated snapshot
Each processing activity is connected via an M2N relationship to the catalogue assets, the recipient providers and the associated DPIAs. From the RoPA you jump to the real asset with one click. When the authority requests it, it is exported in minutes, not reconstructed in a spreadsheet on a Friday.
Mandatory legal basis and versioning
A processing activity cannot be activated without a legal basis under Art. 6 (and an Art. 9 condition if special categories are involved). Every change is versioned in an append-only fashion, with links to assets, providers and DPIAs frozen in the snapshot, so you can reconstruct which RoPA was in force on any given date.
The limits (what we do not claim)
The RoPA is a connected and auditable record, not a purpose enforcement engine: declaring a processing activity for "marketing" does not technically prevent the data from being processed for another purpose at the data layer. The data controller (DPO) is recorded as free text, not as a linked user.
How Linedat helps
Linedat keeps the RoPA tied to the real catalogue and versioned, with export in minutes. From "I'll reconstruct it in a week" to "I'll export it now", with processing activity ↔ asset ↔ DPIA traceability.
Related capabilities
Citizen rights are not managed by email: with the Art. 12 clock and data location via the RoPA.
PII Sanitisation Before Reaching the ModelBefore a national ID or an IBAN leaves for OpenAI, it is redacted — in the critical path, not as an option.
Audit Chain: Verifiable Cryptographic IntegrityOther catalogues store logs. Linedat stores proof — verify it with a button.