ropa-maintenance-workflow

name	ropa-maintenance-workflow
title	RoPA Maintenance Workflow
description	Establishes ongoing RoPA maintenance processes including update triggers, change management integration, version control, stakeholder review cycles, and completeness verification procedures. Activate for RoPA updates, record maintenance, change management, version history, review scheduling.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/ropa-maintenance-workflow
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	general
practice	data-protection
language	en

RoPA Maintenance Workflow

Overview

Creating a RoPA is a point-in-time exercise; maintaining it is a continuous obligation. GDPR Art. 5(2) accountability requires that processing records reflect current reality at all times. The Belgian DPA in Decision 21/2022 sanctioned an organisation whose RoPA had not been updated for over two years despite significant processing changes. This skill establishes the governance framework, triggers, workflows, and verification procedures to keep the RoPA accurate, current, and audit-ready.

Update Triggers

A RoPA update must be initiated when any of the following events occur:

Mandatory Triggers (Immediate Update Required)

Trigger Event	Affected Fields	Update Deadline
New processing activity introduced	All Art. 30(1) fields for new entry	Before processing commences
Processing activity discontinued	Entire entry archived	Within 30 days of cessation
Change in processing purpose	Art. 30(1)(b) — purposes	Before new purpose is acted upon
New category of data subjects added	Art. 30(1)(c) — data subjects	Before data collection from new category
New special category data processed	Art. 30(1)(c) — personal data; Art. 9(2) condition	Before processing begins
New processor engaged	Art. 30(1)(d) — recipients	Before processor begins processing
Processor terminated	Art. 30(1)(d) — recipients	Within 30 days of termination
New international transfer	Art. 30(1)(e) — transfers	Before transfer commences
Transfer mechanism invalidated	Art. 30(1)(e) — transfers	Immediately (processing must cease or alternative mechanism implemented)
Retention period changed (legal or policy)	Art. 30(1)(f) — retention	Within 30 days of change
Material change to security measures	Art. 30(1)(g) — security	Within 30 days of change
DPO appointment or change	Art. 30(1)(a) — controller identity	Within 14 days of change
Organisational restructuring affecting controller identity	Art. 30(1)(a) — controller identity