Record of Processing Activities (ROPA)
Learn how to build, document, and maintain your record of processing activities — the centerpiece of your Law 25 compliance program.
What is the registry?
The Record of Processing Activities (ROPA) is a structured document that lists all operations performed on personal information within your organization. For each processing activity, you document the purpose (why this data is collected), the categories of data subjects, the types of data, recipients, retention periods, and security measures. It is the cornerstone of your compliance file.
Creating a processing activity
Two approaches are available. The ROPA Assistant offers pre-configured templates by industry: click a template, adjust the information to your situation, and save. You can also create a blank activity from Map > Processing activities. In both cases, Conformaze guides you through the required fields and provides contextual suggestions.
Creating a processing activity
Legal bases and purposes
Each processing activity must be justified by a legal basis. Under Law 25, the most common bases are consent, performance of a contract, and legal obligations. If you also operate under the GDPR, additional bases (legitimate interest, public interest mission) are automatically added. Conformaze displays the applicable options based on the jurisdictions you have selected.
Versioning and approval
The registry evolves over time. Each major change creates a new version, with the author's identity and timestamp. The approval workflow (RACI) allows you to submit the registry for validation by the DPO or the executive. Once approved, the registry can be exported as a watermarked PDF and archived. ROPA approval is conditional on the validation of associated PIAs.
Versioning and approval
Keeping the registry up to date
A registry is only useful if it's current. Conformaze helps you maintain it through scheduled reviews, drift alerts (when reference data changes), and automated tasks. Make a habit of reviewing your registry at least once a year, or whenever there is a significant change in your operations (new system, new sub-processor, new purpose).
Tip
Schedule an annual review in Conformaze (Scheduled Reviews) to receive an automatic reminder and keep your certified ROPA up to date.
Processing activity inventory
From Map > Processing activities, the list view gives you an immediate snapshot of your register. Each row shows the activity name, its status (draft, under review, approved), the assigned responsible person, the last revision date, and its completeness score. A red "Missing PIA" badge flags activities that require an impact assessment before approval. An orange "Review due" badge appears when the planned review period has lapsed. Filter activities by department, legal basis, or status in a few clicks. A global registry score, visible at the top of the page, consolidates all these indicators and reflects the progress of your compliance program.
Processing activity inventory
Data mapping
From Map > Processing activities (Data Map view), the network view visually displays the connections between your processing activities, actors (sub-processors, partners), and assets (systems, applications). Each node represents an entity; each arc represents a dependency link or a flow of personal information. Hover over a node to see its details; click to open its full record. Use the "Relationship type" filter to display only out-of-Quebec transfers — shown in orange — or flows involving sensitive personal information — shown in red. This view is particularly useful during a PIA to quickly identify critical dependencies and cross-border transfers that require special attention.
Data mapping
Quick creation assistant
From Map > Processing activities > New activity > Assistant, create a complete activity in five steps. (1) Select a processing category: Human Resources, Marketing, CRM, Finance, etc. (2) Choose a pre-configured template adapted to your industry. (3) Review and adjust the pre-filled fields (purpose, legal basis, personal information categories). (4) Add the associated actors and assets from your directory. (5) Save as a draft to continue later, or publish directly if the information is complete. The assistant reduces activity creation time by 60–90%, while ensuring that all required fields are documented according to Law 25 requirements.
Quick creation assistant