Records of processing
Also known as: record of processing activities · ROPA · processing inventory
Records of processing are the documented inventory of what an organization does with personal information: which data, for which purposes, kept how long, shared with whom.
It is the first document a regulator asks for, because it immediately reveals whether the organization knows what it processes. A company that cannot produce it cannot demonstrate any of the other principles.
It does not need to be a tool: a maintained spreadsheet is enough, provided it genuinely covers the processing and not only what someone remembers.
Building it has a useful side effect: filling it in is how most organizations discover flows they had forgotten, especially into tools a team adopted without going through management.
What it means for a small business
An hour spent honestly listing your tools and what each one receives produces more real compliance than a ten-page privacy policy copied from elsewhere.
Related terms
So what actually applies to you?
A definition tells you what a term means, not what your organization must do. The assessment answers the second question — free, no credit card.
Updated September 1, 2026 · Educational definition; not legal advice.