Records of processing (ROPA). What data you hold, why, where it goes and how long you keep it.
Services · Documentation
Records of processing, privacy notices and policies that match how your organisation really handles personal data.
Compliance is not only what you do. It is also what you can show. Clear records let you answer questions from data subjects, support your registration with POTRAZ, and respond quickly if something goes wrong. Good documents also make staff behave consistently, because everyone can see the rules.
Records of processing (ROPA). What data you hold, why, where it goes and how long you keep it.
Privacy notices and policies. Plain-language statements for customers, staff and website visitors.
Data protection policy. The internal rules your people follow.
Retention schedule. How long each type of data is kept and how it is deleted.
Data-subject request procedure. How you handle access, correction and deletion requests.
Breach response plan. Who does what, and how and when you notify the Authority.
Discover. We interview your teams and review your systems and forms.
Draft. We write documents that match how you really operate.
Review. You check them and we adjust until they are accurate.
Train. We brief the people who must follow them.
Maintain. We update them as your organisation changes.
Documentation works best alongside a CDPA assessment, a Data Protection Officer and ongoing privacy governance. Our guide on breach notification explains the response plan in more detail.
Data protection consultant. Practical CDPA advice from filing to day-to-day compliance.
DPIA services. Assess privacy risk before you launch or change a system.
DPO as a Service. A certified Data Protection Officer without a full-time hire.
Data controller registration. Register with POTRAZ using Form DP1.
CDPA assessment. Find your gaps and build a plan to close them.
A ROPA is a register of what personal data you process, why, who it comes from, who receives it, where it is stored and how long you keep it. It is the foundation of most other compliance work.
If you collect personal data, you should tell people what you collect, why and what rights they have. A privacy notice or policy is how you do that. It should match what you actually do.
Templates are a starting point, but a policy that does not match your real practice can hurt you. We tailor documents after learning how your organisation handles data.
Records of processing, privacy notices, data protection policies, retention schedules, data-subject request procedures and breach response plans.
Review them at least yearly and whenever you add a system, change a supplier or start using data for a new purpose.
Tell us about your organisation and what you need. We will reply with questions and a proposed way forward. Email dpo@privacycure.com, message us on WhatsApp or use the contact form.