Help Centre

Each processing activity in your ROPA is a separate record. Create one entry for each distinct purpose of processing — for example, "Staff Payroll", "Patient Appointment Booking", and "Marketing Emails" would each be separate entries.

How to create a new ROPA entry

1. 1 Go to Dashboard → ROPA.
2. 2 Click the + New Entry button (bottom right).
3. 3 Fill in the Processing Activity Name — keep this descriptive, e.g. "HR Employee Records".
4. 4 Select the Purpose of Processing from the dropdown (customisable in Settings → Custom Dropdowns).
5. 5 Select the Legal Basis under UK GDPR Article 6. For special category data, also select an Article 9 condition.
6. 6 Add the categories of personal data processed using the multi-select field.
7. 7 Add the categories of data subjects.
8. 8 Link relevant information assets, services, and suppliers using the relationship fields.
9. 9 Set the retention period and statutory basis.
10. 10 Set the Data Controller status (Controller, Processor, or Joint Controller).
11. 11 Click Save.

Legal basis options (Article 6)

• 6(1)(a) — Consent: the individual has given clear consent.
• 6(1)(b) — Contract: processing is necessary to fulfil a contract with the individual.
• 6(1)(c) — Legal obligation: processing is required by law.
• 6(1)(d) — Vital interests: processing is necessary to protect someone's life.
• 6(1)(e) — Public task: processing is necessary for a public interest task or official function (common for NHS and public bodies).
• 6(1)(f) — Legitimate interests: processing is necessary for your or a third party's legitimate interests (not available to public authorities for their official duties).

Special category data (Article 9)

If your processing involves health data, biometric data, ethnic origin, political opinions, religious beliefs, or other special categories, you must also record your Article 9 condition. Common NHS conditions are 9(2)(h) — health or social care purposes — and 9(2)(i) — public health.