What is ROPA (Register of Treatment Operations)?

Definition

ROPA is an acronym for Record of Processing ActivitiesThis translates to Data Processing Operations Log (or Data Processing Activities Log). It is the document that describes, in an organized manner, all the activities in which the organization processes personal data: what is collected, from whom, for what purpose, on what legal basis, for how long, with whom it is shared, and how it is protected.

What does the LGPD say?

Article 37 of the General Data Protection Law (Law No. 13.709/2018) It determines that the controller and the operator must keep a record of the personal data processing operations they carry out, especially when the processing is based on legitimate interest. The record is also the main evidence requested by the National Data Protection Authority (ANPD) in inspections and the basis for the Impact Report (RIPD).

What does a ROPA contain?

• the treatment activity and the area responsible for it;
• the purpose and legal basis of each treatment;
• The categories of personal data and data subjects involved, with emphasis on sensitive data and data concerning children and adolescents;
• the systems, suppliers and operators involved in the treatment;
• international sharing and transfers;
• the retention period and disposal;
• The security measures implemented and the risks identified.

Who should maintain the ROPA?

Controllers and operators, of any size and sector. Small data processing agents may adopt a simplified format, as per ANPD regulations, but they are still obligated to register.

How to build and maintain the record.

1. Map the processes which use personal data, area by area, with interviews and systems analysis.
2. Classify Each activity includes: data, data owners, purpose, legal basis, retention, and sharing.
3. Match risks and controls.so that the record feeds into the RIPD and action plans.
4. Define responsibilities and schedule periodic reviews.ROPA is only valid if it reflects current operations.

How Privacy Tools ROPA deals with

On the platform, the ROPA is generated and maintained within the module. Data MappingTreatment activities are registered or imported from spreadsheets, organized by collection point, legal basis, and risks, and exported as a report for audits and inspections. Learn more on the page. CLOTHES in Privacy Tools.

Related terms

RIPD · LIA · DSAR · Back to glossary

Updated October 3th, 2026.