ROPAManagerLite

Read-only variant of ROPAManager. Renders the summary stats, lawful-basis breakdown, risk indicators, compliance-gap alerts, and the records table — without the form, edit affordances, or CSV-export panel.

Overview

ROPAManagerLite is the display-only counterpart of ROPAManager. It renders the same summary cards (total records, active records, cross-border records, records with gaps), the same lawful-basis breakdown, the same risk indicators (sensitive data, DPIA required, automated decisions, due for review), the same compliance-gap alerts, and the same records table — but the add/edit form, the validation utilities, and the CSV-export panel are not bundled.

Reach for it on internal dashboards, audit reports, and DPO review pages. For the full read/write surface, use the regular ROPAManager from the same module.

import { ROPAManagerLite } from '@tantainnovative/ndpr-toolkit/ropa/lite';

Production Readiness

Use this checklist when moving ROPAManagerLite from demo mode into a customer-facing workflow. Pair the UI package with the source templates in @tantainnovative/ndpr-recipes so validation, persistence, and audit behavior live in your own backend.

Import path
Use
Production role
@tantainnovative/ndpr-toolkit/ropa/lite
ROPAManagerLite
Read-only ROPA summaries, gap alerts, and processing-record tables.
@tantainnovative/ndpr-toolkit/ropa
ROPAManager, validateProcessingRecord
Full read/write manager and validation path for admins and record owners.
@tantainnovative/ndpr-recipes
src/nextjs/app-router/api/ropa/route.ts
Reference backend source for durable records consumed by read-only views.

Implementation checklist

  • Feed lite views from the same backend records used by the full ROPA manager.
  • Use onRecordClick only for routes the current user is allowed to open.
  • Show review dates, stale-record gaps, and archived status clearly on audit dashboards.
  • Keep write actions out of lite pages; route editors to the full manager or admin workflow.
  • Document which audience each lite view serves: executive summary, DPO review, audit export, or team dashboard.

Backend notes

  • Use the recipes ROPA route or adapter as the source of truth, then project read-only records into the lite component.
  • Apply authorization before fetching data; hiding edit controls is not an access-control boundary.
  • Return stable record IDs so row click-through and audit links remain durable.
  • Filter or redact records before public or customer-facing transparency views.

Testing notes

  • Compare lite summaries with the full ROPA manager and backend record counts.
  • Check overdue reviews, compliance gaps, archived records, and empty states.
  • Verify keyboard activation works for clickable rows.
  • Confirm unauthorized users cannot fetch hidden record details through linked routes or APIs.

Common mistakes

  • Using lite pages as the only ROPA workflow and losing edit, validation, and approval controls.
  • Passing stale static JSON while the production ROPA backend changes.
  • Assuming read-only UI replaces backend authorization.
  • Showing sensitive processing details to broad audiences without redaction.

Quickstart

import { ROPAManagerLite } from '@tantainnovative/ndpr-toolkit/ropa/lite';
import type { RecordOfProcessingActivities } from '@tantainnovative/ndpr-toolkit';

const ropa: RecordOfProcessingActivities = {
  id: 'ropa_001',
  organizationName: 'Acme Ltd',
  organizationContact: 'privacy@acme.example',
  organizationAddress: '12 Marina Road, Lagos',
  version: '1.0.0',
  lastUpdated: Date.now(),
  records: [
    {
      id: 'rec_001',
      name: 'Order fulfilment',
      description: 'Processing customer orders end to end.',
      department: 'Operations',
      controllerDetails: {
        name: 'Acme Ltd',
        contact: 'privacy@acme.example',
        address: '12 Marina Road, Lagos',
      },
      lawfulBasis: 'contract',
      lawfulBasisJustification: 'Necessary to perform the purchase contract.',
      purposes: ['Fulfil and ship customer orders'],
      dataCategories: ['Contact info', 'Order history'],
      dataSubjectCategories: ['Customers'],
      recipients: ['Logistics partner'],
      retentionPeriod: '7 years',
      securityMeasures: ['Encryption at rest', 'Access control'],
      dataSource: 'data_subject',
      dpiaRequired: false,
      automatedDecisionMaking: false,
      status: 'active',
      createdAt: Date.now(),
      updatedAt: Date.now(),
      lastReviewedAt: Date.now() - 86400_000 * 30,
      nextReviewDate: Date.now() + 86400_000 * 60,
    },
  ],
};

export default function ROPAOverview() {
  return (
    <ROPAManagerLite
      ropa={ropa}
      showSummary
      showComplianceGaps
      onRecordClick={(r) => router.push(`/ropa/${r.id}`)}
    />
  );
}

Props

PropTypeDescription
ropaRecordOfProcessingActivitiesRequired. The full ROPA whose records are displayed. Matches the full ROPAManager API.
titlestringHeader. Defaults to "Record of Processing Activities (ROPA)".
descriptionstringSub-header. Defaults to an NDPA accountability-principle explainer.
showSummarybooleanToggle the four-stat summary cards plus the lawful-basis / risk-indicator panels. Defaults to true.
showComplianceGapsbooleanToggle the gap-alert banner powered by identifyComplianceGaps. Defaults to true.
onRecordClick(record: ProcessingRecord) => voidOptional row callback. When provided, each row becomes keyboard-accessible (Enter / Space activates).
classNamestringExtra class merged onto the root.
classNamesROPAManagerLiteClassNamesPer-slot overrides (root, header, title, summary, summaryCard, table, tableHeader, tableRow, statusBadge, complianceScore, gapAlert).
unstyledbooleanStrip every default class.

Built-in row highlights

The table colour-codes rows so reviewers can scan for problems:

  • Red — review is overdue (nextReviewDate is in the past).
  • Yellow — record has at least one compliance gap from identifyComplianceGaps.
  • White / surface — healthy.

When NOT to use the Lite variant

  • You need a DPO to add, edit, or archive records — use the full ROPAManager.
  • You need CSV export — use exportROPAToCSV from /core (or the full manager's export panel).
  • You want server-side validation — pair with validateProcessingRecord from /core.