Privacy and data protection support
Records of processing (RoPA)
A record of processing is an inventory exercise that fails when it is done as a questionnaire. We build it system by system from what the organisation actually runs, in a structure that can be maintained rather than rebuilt annually.
- Published price
- $1,500–5,000 / build
- Turnaround
- 5 business days
- Without us
- $10,000–40,000
Fixed per unit, not hourly. No minimum engagement. Quoted before we start.
What you receive
A complete record of processing activities, built system by system to the required schema.
- A complete record covering every processing activity, in the required schema
- Purposes and lawful bases recorded per activity, as instructed
- Data categories and data subject categories mapped per activity
- Recipients and processors listed, with the contract reference for each
- International transfers recorded with the transfer mechanism relied on
- Retention periods and security measures per activity, plus a maintenance guide
What it costs, and what it replaces
Both figures are published ranges for the same unit of work. Ours is fixed before we start; if our process gets faster, that is our gain and your price does not move.
How engagements are structured →- Adnah Legal
- $1,500–5,000 / build
- Typical cost without us
- $10,000–40,000 / build
Roughly 87% lower at the midpoint of each published range.
How the work runs
01
System inventory
We start from the systems the organisation actually runs, not from a list of departments. Records built department by department miss shadow systems and double-count shared ones.
02
Activity mapping
Each system is mapped to the processing activities it supports, with data categories, subjects and recipients recorded per activity rather than per system.
03
Transfers and retention
International transfers are recorded with the mechanism relied on, and retention periods are recorded as they are actually operated, flagging where practice and policy diverge.
04
Maintainable delivery
The record is delivered in a structure designed for updating, with a short maintenance guide covering what triggers an update and who should make it.
What we need from you
- A system or application inventory, or authority to build one from interviews and documentation
- Vendor and processor contracts
- Existing privacy notices and any prior record
- Your instruction on lawful bases
What we check before delivery
- Every activity is checked for the full set of required fields; no field is silently blank
- Processor entries are verified against an actual contract reference
- Transfer mechanisms are checked as present wherever a non-domestic recipient is recorded
- Retention periods are checked against both policy and observed practice, with divergence flagged
When firms send us this
- Organisations that have never built a record and are now being asked for one
- Records that exist on paper but have not been updated in two years
- Post-acquisition integration where two records need merging
- Preparing for a regulator request or a customer security review
Questions about records of processing
Do you interview the client's staff?
Only with your involvement and consent, since the relationship is yours. Most of the work can be done from documentation and system exports, with a short list of questions routed through you.
Do you determine lawful bases?
No. You instruct on lawful bases; we record them consistently and flag activities where the basis recorded does not fit the processing described.
What format do we get?
A structured spreadsheet or your GRC platform's import format. It is designed to be maintained, which matters more than how it looks in the first month.
Firms who send us this usually also send
More in Privacy and data protection support
All privacy and data protection support services →This service
Send one and judge the output.
Records of processing at $1,500–5,000 per build, 5 business days. No minimum, no scoping call, no onboarding cycle.