Records of Processing Activities (ROPA)

Overview

The ROPA (Records of Processing Activities) component helps organisations create, maintain, and manage a register of all personal data processing activities. This is a key accountability requirement under the Nigeria Data Protection Act 2023 (NDPA).

Installation

Install the NDPR Toolkit package which includes the ROPA components:

pnpm add @tantainnovative/ndpr-toolkit

Import

Import from the main package:

import {
  ROPAManager,
  useROPA,
  validateProcessingRecord,
  generateROPASummary,
  exportROPAToCSV,
  identifyComplianceGaps,
} from '@tantainnovative/ndpr-toolkit';

Components

The ROPA module includes three primary components:

import { ROPAManager } from '@tantainnovative/ndpr-toolkit';

<ROPAManager
  activities={processingActivities}
  onAdd={(activity) => console.log('Added:', activity)}
  onEdit={(activity) => console.log('Edited:', activity)}
  onDelete={(id) => console.log('Deleted:', id)}
  onExport={(format) => console.log('Exporting as:', format)}
/>

import { useROPA, exportROPAToCSV } from '@tantainnovative/ndpr-toolkit';

function ProcessingRecords() {
  const { ropa, addRecord, getSummary } = useROPA({
    initialData: {
      id: 'ropa-1',
      organizationName: 'Your Company Ltd',
      organizationContact: 'dpo@yourcompany.com',
      organizationAddress: 'Lagos, Nigeria',
      records: [],
      lastUpdated: Date.now(),
      version: '1.0',
    },
  });

  return (
    <div>
      <ROPAManager
        records={ropa.records}
        onAddRecord={addRecord}
        summary={getSummary()}
      />
      <button onClick={() => exportROPAToCSV(ropa.records)}>
        Export to CSV
      </button>
    </div>
  );
}

API Reference

ProcessingActivity Type

type ProcessingActivity = {
  id: string;
  name: string;
  description: string;
  purpose: string;
  lawfulBasis: LawfulBasisType;
  dataCategories: string[];
  dataSubjects: string[];
  recipients: string[];
  crossBorderTransfers?: {
    country: string;
    safeguards: string;
  }[];
  retentionPeriod: string;
  securityMeasures: string[];
  dpiaConducted: boolean;
  status: 'active' | 'inactive' | 'under_review';
  createdAt: string;
  updatedAt: string;
};

type ROPAManagerProps = {
  activities: ProcessingActivity[];
  onAdd: (activity: ProcessingActivity) => void;
  onEdit: (activity: ProcessingActivity) => void;
  onDelete: (id: string) => void;
  onExport?: (format: 'csv' | 'pdf' | 'json') => void;
  filterCategories?: string[];
};

Best Practices

• Comprehensive Coverage: Record every processing activity, including those handled by third-party processors.
• Regular Updates: Review and update your ROPA at least quarterly, or whenever a new processing activity is introduced.
• Link to DPIA: Cross-reference processing activities with any Data Protection Impact Assessments that have been conducted.
• Include Retention Periods: Clearly document how long data is retained for each activity and the basis for that period.
• Audit Trail: Maintain a history of changes to each record for accountability purposes.

Need Help?