AI Governance Engineer
GitHub

Records of processing activities (ROPA)

By Updated

The GDPR Article 30 record of each processing activity: purposes, categories of data and people, recipients, transfers, retention and security 1. For AI it is best generated per processing moment from the registry and data cards, so it does not go stale.

Developed in
ch. 19, Records of processing
Chapters
ch. 19, Privacy & AI
Source
1 numbered reference, listed below

Where it is used

One chapter of the Body of Knowledge uses the term. Each link opens the first section that does.

  • Data card

    Structured, versioned documentation of a dataset (provenance, lawful basis, rights, composition and known limitations) maintained as code alongside the system.

Sources

  1. [1] Regulation (EU) 2016/679 (General Data Protection Regulation) (Arts. 4(1), 4(5), 4(7), 4(8), 4(12), 4(14), 5, 6, 9, 12(3), 22, 25, 28(2) and 28(4), 30, 33, 35; Recital 26). Publications Office of the EU (EUR-Lex). 2016-04-27. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Records of processing activities (ROPA). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/records-of-processing-activities-ropa. CC BY 4.0

BibTeX

@misc{aige2026recordsofprocessingactivitiesropa,
  author  = {Jorge García Aibar},
  title   = {{Records of processing activities (ROPA)}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/records-of-processing-activities-ropa}
}