RoPA Management

DataGrail offers a streamlined and guided experience for creating and maintaining an up-to-date Record of Processing Activity (RoPA).

RoPAs are managed at the Processing Activity level, allowing your team to easily manage RoPAs across multiple systems in your organization that are assigned to a given Processing Activity.

This document describes how RoPAs are created, edited, exported, and maintained.

Navigating RoPAs

Every Processing Activity in your account will automatically be associated with a RoPA when created. To access a RoPA:

1. Navigate to the Processing Activities page.
2. Select the relevant Processing Activity.
3. Select the RoPA tab from the top menu.

Populating RoPA Details

To guide you towards completing all required RoPA fields, you will see a progress indicator in each section of your RoPA. If all required fields in a section have been filled out, you will see a green check mark. Otherwise, you will see an Incomplete Data icon.

RoPA data can be filled out in three ways:

1. Automatically through DataGrail’s Intelligence Library: DataGrail pre-fills critical information on systems, such as the personal data categories it likely processes, and whether there is potential for AI usage within the tool.
2. Automatically through completed System Profiles: If you've made any edits to your System Profiles, the most recent data in the System Overview will additionally be used to pre-fill any corresponding RoPA fields.
3. Manually through the RoPA editor: The RoPA view allows DataGrail users to fill in details manually at the RoPA level.

Data from DataGrail’s Intelligence Library will not be considered for a given system if it has been manually populated by your team. RoPA fields that have been populated automatically will show a Pre-Filled icon.

If you already maintain a RoPA in another tool, you can import it to create your Processing Activities and pre-fill their RoPA answers in one step.

A RoPA is a live document — there's no separate edit mode and no save button. Select into any field to update it, and your changes save automatically. DataGrail periodically saves a snapshot of the RoPA as you and your contributors work, so you can always review how it has changed over time. Select the Change History tab to see previous snapshots.

To have Vera recommend RoPA field values from your uploaded documents, select Analyze with Vera on the Processing Activity's Attachments tab. See System and Processing Activity Analysis for details.

Admins can manage the customer-wide labels and selectable options used in RoPA fields from Settings > Field Configuration. See Field Configuration for details.

Best Practice

Leverage the AI-generated system data by adding relevant systems to your processing activities. Always review this information against your company's unique use cases and policies to make the final legal calls. After your review, simply complete any remaining fields or use 'N/A' if a question doesn't apply.

Customizing the Template

Admins can customize the structure of the RoPA by editing its shared template. The template defines which questions appear on every Processing Activity's RoPA — a question you add to it appears on every RoPA immediately, and a question you remove disappears from every RoPA, along with any answers already recorded for it.

1. Navigate to a Processing Activity and select the RoPA tab.
2. Select Edit Template at the bottom of the RoPA.

Changes Affect Every Processing Activity

Editing the template updates every RoPA in your account, not just the one you opened it from.

The template has two sections.

Section	Description
Standard Fields	The default fields available on every RoPA. These fields are locked — you can't edit their question text, answer options, or order.
Custom Questions	Questions you add yourself. Select + Add Question to get started.

Custom questions use the same question builder available for Risk Assessment templates. Choose from the basic answer types and write your own answer options.

Inviting Contributors

A comprehensive RoPA requires input from across your organization. To make this collaboration simple and secure, you can invite contributors to provide their expertise on specific processing activities.

Contributor access is secure by design. It is temporary and limited only to the activities you share, ensuring stakeholders can provide necessary details without granting them full access to your privacy program.

Select Add External Contributors to invite individuals to see, edit, and review the specific RoPA report that you have shared with them.

Export a RoPA

A RoPA is a living document. DataGrail continuously monitors for new systems and new data categories, helping you keep your RoPA up-to-date as your organization evolves.

Before exporting a RoPA, ensure the following:

• A Data Protection Officer or Representative has been assigned in Settings > Reporting Contacts.
• All of your Processing Activities have complete RoPA data, with no missing mandatory fields.
• All Processing Activities have been reviewed and updated recently (we recommend a review at least every 180 days).

To download your RoPA, just select Download RoPA from the Processing Activities page. The CSV export offers the flexibility to fine-tune formatting and meet your specific reporting needs.

The RoPA CSV will export all Processing Activities that you have in your Processing Activity table, along with the associated systems and the details in each Processing Activities RoPA tab.

Change History

The Change History tab provides a complete audit trail of every modification made to a Processing Activity and its RoPA, including who made each change and when.

Tracked events include:

Category	Events
Questions	Answer added, edited, or cleared
Template	A custom question was added to or removed from the shared template
Contributors	Contributor added, removed, or name changed
Documents	Document uploaded or deleted
Systems	System added to or removed from the Processing Activity, including any resulting RoPA answer changes
Contacts	Contact added to or removed from a linked system
Snapshots	A new RoPA snapshot was taken
Status	Processing Activity created, archived, or renamed

Each entry displays the actor's name (or "API Submission" for programmatic changes), the action taken, and a timestamp. Recent activity (within 24 hours) shows relative times like "2 hours ago," while older entries display the full date and time.

Select any entry to expand it and view details such as before/after values for edits. Where an entry references a specific question, select it to jump directly to that field in the RoPA.

Filtering and Export

Use the Filter dropdown to narrow the history by category (Questions, Contributors, Documents, etc.). Select Export CSV to download the filtered history — useful for audit documentation or sharing activity summaries with stakeholders.

Ensuring Long-Term Compliance

To ensure that your RoPA is audit-ready, DataGrail will alert you to Processing Activities that have incomplete RoPA data and that have not been reviewed in over 180 days.

Segment your Processing Activities by the ones that need your attention using the following filters on the Processing Activities page:

• RoPA Data: Show Incomplete Data - Use this filter to isolate Processing Activities with missing fields, based on Article 30 requirements.
• Last Updated: 180 days ago - Use this filter to isolate all Processing Activities that haven't been reviewed for at last 180 days.