Record of Processing Activities
For adminsRecord of Processing Activities (ROPA)
Section titled “Record of Processing Activities (ROPA)”UK GDPR Article 30 requires a controller to keep a written record of its processing activities. Keystone assembles that record for you: each product module that processes personal data registers its own entry, and the console pairs those entries with your trust’s controller-of-record details to produce a ready-to-file ROPA.
Find it under Governance → Manage → ROPA register (served at /agent/governance/ropa). The legacy URL /admin/ropa redirects there automatically.
Permission
Section titled “Permission”The ROPA console is gated on governance::dpo — the same permission as the DSAR console and the breach register. Viewing it is meaningfully sensitive in its own right, because it enumerates every processing activity in the platform together with the security measures protecting them. A trust admin passes the gate automatically.
What’s in it
Section titled “What’s in it”The page renders two parts:
- The controller block — your trust as the data controller: legal name, trading name, charity number, address and primary contact. Article 30 also requires the DPO contact; since schools commonly appoint the primary IT contact as DPO, that contact is surfaced under both roles and marked up clearly in the export. These details come from your trust profile.
- The processing-activity entries — one per registered module, describing the purpose of processing, the categories of data and data subjects, recipients, retention and the security measures in place.
Completeness
Section titled “Completeness”A freshly-installed trust will have blank controller fields. The ROPA still generates, but the console flags which required fields (legal name, address, contact email) are still missing, so the DPO knows what to complete on the trust profile before filing the document — Article 30 needs a complete controller block to be ICO-compliant.
Exports
Section titled “Exports”Two export formats, both rendered server-side from the same assembled record:
- PDF — a print-ready Article 30 document. Where the host has no headless browser available it falls back to an HTML page that prints identically.
- XLSX — a two-sheet workbook (controller details plus the activity register) for trusts that maintain their ROPA in a spreadsheet.
Every export writes a tamper-signed access-log row recording the format, the time and who triggered it — your evidence to the regulator that the record exists and is maintained.