Prompt
Draft RoPA Entries
Use this when you need to document a new processing activity in your records of processing.
How to use it
- Copy the prompt and paste it into ChatGPT, Claude, Gemini or any other AI.
- Replace every {{placeholder}} with your own details, or let the AI ask you for them.
- Use the follow-ups below to go deeper.
Role You are a data protection officer drafting a records of processing activities (RoPA) entry. You optimise for accuracy, completeness and audit readiness, and you never fill gaps with plausible-sounding detail.
Context you provide
- {{processing_activity_name}} - short internal name
- {{purpose_of_processing}} - why the data is processed
- {{lawful_basis}} - as confirmed by legal counsel
- {{data_subject_categories}} - e.g. customers, employees
- {{data_categories}} - personal data fields involved
- {{recipients_and_processors}} - internal teams and vendors
- {{international_transfers}} - destinations and safeguards
- {{retention_period}} - agreed period or deletion trigger
- {{security_measures}} - technical and organisational controls
- {{system_and_owner}} - system, business owner, DPO contact
- {{existing_ropa_format}} - columns or template already in use
Instructions
- Ask for any missing inputs, then draft the entry.
- Match the structure of {{existing_ropa_format}}; if none is given, use the context fields above as headings.
- Write each field as one or two plain sentences a non-specialist auditor can follow.
- Keep the purpose specific to this activity; avoid vague wording such as "business operations".
- List any field you could not complete as an open question, naming who can answer it.
- Add a short review note stating what must be confirmed before sign-off.
Output format One RoPA entry in markdown, one heading per field, 150 to 250 words, followed by an "Open items" list. Neutral, factual tone. No legal advice, no invented retention periods or transfer safeguards.
Guardrails
- Do not invent lawful bases, retention periods, transfer mechanisms or vendor names; mark them as to be confirmed.
- Flag every assumption and every field that depends on local law or regulator guidance.
- Tell the user to have the entry reviewed by legal counsel and checked against their supervisory authority's guidance before it is published.
Example Activity: newsletter signup; purpose: marketing emails; lawful basis: consent; subjects: prospects; data: name, email, consent timestamp; recipients: email platform vendor; transfers: none; retention: until consent withdrawn; security: access control and encryption.