Do you need a record of processing activities (RoPA) under the DPDP Act?
Not by law, but you need one in practice. The DPDP Act does not use the term RoPA or require one by name, unlike Article 30 of GDPR. Yet you cannot give a proper notice, erase data on time, secure it or report a breach without knowing what personal data you process, why, where and for how long.
Why does the DPDP Act not mention a RoPA?
The DPDP Act is short and principle-based. It sets outcomes, such as notice, purpose limitation, security and erasure, and leaves the method to the Data Fiduciary. GDPR, by contrast, spells out a record-keeping duty. See DPDP vs GDPR for the wider differences.
Which DPDP duties depend on a RoPA?
Almost every core duty of a Data Fiduciary assumes you know your processing:
- Notice (Rule 3): you must list each item of personal data and its specific purpose.
- Purpose limitation and lawful ground: each purpose needs consent or a legitimate use under Section 7.
- Erasure (Section 8(7)): you must erase data once the purpose is served or consent is withdrawn, so you need to know each purpose and retention period.
- Security safeguards (Rule 6): you cannot encrypt, restrict access to or log systems you have not listed.
- Breach reporting (Rule 7): you must tell each affected person, so you need to know whose data sat in the breached system.
- Rights requests: to give a person a summary of their data and who it was shared with, you need to know where it lives.
- Questions from the Board: a current register is the quickest way to answer what you process and why.
What should a DPDP RoPA contain?
A DPDP RoPA should record, for each processing activity, the fields below:
| Field | What to record | DPDP duty it supports |
|---|---|---|
| Processing activity | A plain name, such as payroll or order fulfilment | All |
| Purpose | The specific purpose of the processing | Notice, purpose limitation |
| Lawful ground | Consent, or the legitimate use under Section 7 | Lawful processing |
| Data Principals | Customers, employees, patients, students and so on | Notice, rights |
| Personal data items | Each item, such as name, phone, Aadhaar, health details | Itemised notice (Rule 3) |
| Children's data | Whether anyone under 18 is involved, and how parental consent is taken | Section 9, Rule 10 |
| Source | Collected from the person, a third party, or digitised from paper | Notice, scope |
| Systems and location | Applications, databases and where they are hosted | Security safeguards (Rule 6) |
| Processors and recipients | Vendors and other parties the data is shared with | Contracts, access requests |
| Transfers outside India | Countries the data goes to | Transfer restrictions (Section 16) |
| Retention and erasure | How long the data is kept and what triggers erasure | Erasure (Section 8(7)), retention (Rule 8) |
| Security safeguards | Encryption, access control, logging, backups | Section 8(5), Rule 6 |
| Owner and review date | Who is accountable, and when it was last checked | Keeping the record current |
How do you build a RoPA for DPDP?
- List your systems, vendors, spreadsheets and offline processes that touch personal data.
- Find the personal data in each one, including exports and shared drives.
- Group the data into processing activities, and record the fields above for each.
- Check each purpose has a lawful ground, and drop the ones that do not.
- Name an owner for each activity and set a review date.
Building the record is step two of our DPDP compliance checklist. A Significant Data Fiduciary will also find it the natural starting point for its yearly Data Protection Impact Assessment.
How GRC Flow helps
GRC Flow drafts a RoPA from your own data inventory and vendor register, and a person reviews it before it can be downloaded (see DPDP documents). Its personal data discovery scans exports to find the personal data that feeds the inventory.
Frequently asked questions
Is a RoPA mandatory under the DPDP Act?
Not by name. The DPDP Act and Rules do not use the term record of processing activities or require one in the way GDPR Article 30 does. But meeting the Act's duties on notice, purpose, erasure, security and breach reporting is very hard without a register of what you process, so most organisations keep one.
What is the difference between a RoPA and a data inventory?
A data inventory lists where personal data is held. A RoPA organises that data by processing activity, adding the purpose, lawful ground, recipients, retention and safeguards for each. Many organisations build the inventory first and the RoPA from it.
What should a RoPA contain under the DPDP Act?
For each processing activity: the purpose, the lawful ground (consent or a legitimate use under Section 7), the categories of personal data and of people, whether children's data is involved, the systems and locations, the processors and recipients, transfers outside India, the retention period and erasure trigger, the security safeguards, and an owner.
Does the DPDP Act require data mapping?
The Act does not use the term data mapping, but its duties assume you know your data. You cannot give an itemised notice, erase data when the purpose ends, secure it or tell affected people about a breach without knowing what you hold and where.
Sources
- KPMG India: DPDP Rules 2025 guidance
- Deloitte India: Point of view on the DPDP Act
- PIB: Digital Personal Data Protection Rules, 2025
This guide explains the law in general terms and is not legal advice. Check specific situations with a qualified lawyer.