Achieving this requires having a robust data governance framework, operationalised through a comprehensive Digital Personal Data Protection Toolkit. At the very foundation of this Toolkit lies the Record of Processing Activities [“ROPA”].
WHAT IS A ROPA?
SIGNIFICANCE AND LEGAL BASIS OF A ROPA
While Article 30 of the EU GDPR specifically defines ROPAs and mandates that they must be maintained by all Data Controllers, the same requirement is not specifically present in the Indian DPDP Act, per se.
That being said, the DPDP Act describes the legal obligation to maintain such a record through various provisions:
- Section 4 of the DPDP Act specifies that processing is only lawful if it is for a “lawful purpose” for which the Data Principal has given consent or for “certain legitimate uses.” A ROPA maintains the record for the specific legal basis for every processing activity, ensuring the organisation does not overstep its legal boundaries.
- Data Fiduciary and Processors are also required to maintain ROPAs to fulfil requests made by Data Principals to exercise their rights, as well as by the Government and Law Enforcement Authorities under the DPDP Act.
- Furthermore, under Section 10 of the DPDP Act, Significant Data Fiduciaries are required to conduct periodic Data Protection Impact Assessments and Data Audits, of which a ROPA serves as the foundational document.
WHAT MUST A ROPA CONTAIN?
In line with this, it must ideally include [at the minimum]:
- The name and particulars of the Data Fiduciary and their representatives,
- The categories of Data Principals and of Personal Data being processed,
- The purposes of and legal bases for processing,
- The categories and particulars of recipients to whom the Personal Data has been/ will be disclosed,
- The transfers of Personal Data abroad [cross-border data transfers],
- The technical and organisational security measures undertaken for Personal Data protection [including for cross-border data transfers],
- The retention period/ timeline for erasure of the different categories of Personal Data.
HOW TO DRAFT AN EFFECTIVE ROPA?
All departments/personnel across the organisation should be involved in this process to ensure that all relevant information is included.
The following steps should be followed to maintain effective ROPAs:
The following steps should be followed to maintain effective ROPAs:
I. Identifying and Classifying the “Processing Activity”
- Firstly, all the processing activities must be categorised [the “Parent” category] and sub-categorised [the “Sub” category].
- The “Parent” category shall include broad organisational functions [like Finances, HR, etc.], whereas, the “Sub” category shall include specific tasks such as payments and invoicing.
- This should be followed by a brief “Description” of the processing activity.
- Further, the organisation’s role as “Data Fiduciary” or “Data Processor” under the DPDP Act must be specified.
- If acting in the capacity of deciding why/how Personal Data is being collected/processed/used, the category of “Data Fiduciary” would be applicable.
- If processing Personal Data on behalf of/ under instruction of a Data Fiduciary, the category of “Data Processor” would be applicable.
- In case of acting in a joint capacity or subordinate category, the organisation’s role as “Joint Data Fiduciary”, “Joint Data Processor” or “Sub-Processor” must be specified.
II. Specifying the Legal Basis and Mapping the Data
- At this stage, it is essential to specify the “Purpose[s]” of Processing the Personal Data.
- Following this, the “Categories of Personal Data” must be specified to specify to whom such data relates, including Data Fiduciary and their employees [when acting in the capacity of a Data Processor], Data Processors and their employees [when acting in the capacity of a Data Fiduciary], etc.
- Further, the “Legal Basis” for processing the Personal Data must be specified in accordance with the relevant provision of the DPDP Act. This includes: Consent under Section 6 and Certain Legitimate Uses under Section 7 [voluntary disclosure, compliance with Court orders/regulations, etc.]
- Particulars for “Confidential Personal Data”, “Sensitive Personal Data”, “Criminal convictions and offences” and “Minors/Persons-with-Disabilities” should be added, and aswered as “Yes/ No”. In case the answer is “Yes”, the category of Personal Data processed must be described briefly, such as: “Payment and bank details”.
- The particulars for “Necessity [is it necessary to process the Personal Data?]” and “Further Processing [for a purpose other than that for which the Personal Data were collected]” should also be added and answered as “Yes/ No”.
III. Data Source and Audit
- Further, the “Data Source” must be specified to describe the source from which the Personal Data was collected.
- Post this, the “Collection Method” of Personal Data must be described [such as: Personal Data is collected directly from the customer during onboarding, service delivery, or communication.]
- Further, the “Legal Basis Documentation” should be added to include the details of the documents that describe the legal basis for collecting and processing Personal Data, essentially the Consent Notice.
- The “Data Disclosure [on a regular basis?]” should be specified as “Yes/ No”, depending on whether the Personal Data is disclosed on a regular basis.
- Under “Data Recipients”, clarify who receives the Personal Data that is processed. Otherwise, specify “None” in case there are no recipients.
IV. Cross-Border Data Transfers
- It is essential to track the “flow” of the Personal Data, especially transfers outside India. For this, the countries to which Personal Data is transferred must be recorded as “Transfers Outside India”. If there are no such transfers, “No transfers outside India” should be specified instead.
- Similarly, the “Processor Location” must be specified for transfers outside India. If there are no such transfers, “Not Applicable” should be used to denote the same.
- Further, under “Third Country Transfer Notes”, a brief description of the Personal Data processed abroad must be added. This may include: “All data stored and processed within India”, “Transfer limited to contact and communication information”, etc.
- Additionally, the “Third Country Transfer Legal Basis” must be specified. This includes Standard Contractual Clauses and other related legal requirements. If such documents are not applicable, this must be clearly stated as “Not Applicable”.
V. Personal Data Retention and Erasure
- Consequently, the “Retention Period” of the Personal Data must be clearly stated, as per the category of the Data.
- Further, the “Retention Justification” must also be specified. For example, Personal Data may be retained to comply with legal requirements.
V. Security and Risk
- Based on the data category, a brief description of the “Security Measures” taken to protect the Personal Data must be provided. For example, for payments and invoicing, “Financial Transactions Procedure: describes issuing invoices, managing payments, and ensuring accounting compliance” may be added.
- Additionally, specify if the Personal Data has been used for “Profiling” and “Automated Decision Making”. If it has, a brief description of the same should be added; otherwise, it should be answered as “None”.





