The processing register problem
The record of processing activities, often called the ROPA, is one of the GDPR’s most fundamental requirements. The supervisory authority can request it at any time, and you are expected to have it ready. Not “soon,” not “we’re working on it” - ready.
For most SMEs, this is where GDPR compliance stalls. Creating a processing register from scratch means you need to identify every activity that involves personal data, determine the legal basis for each, list the data categories, define retention periods, and document security measures. Even if you know what the GDPR requires, translating that into a complete register is tedious and error-prone.
That is exactly why GDPRWise built its three-layer model. Instead of starting from a blank spreadsheet, you start with a register that is already 80% complete.
How the three-layer model works
GDPRWise generates your processing register through three complementary layers. Each layer adds detail and accuracy.
Layer 1: Sector foundation
Every industry has common processing activities. A dental practice processes patient records and appointment data. An online retailer processes orders, payment details, and shipping addresses. An accountancy firm processes client financial records.
GDPRWise maintains pre-built sector foundations for dozens of industries. When you select your sector, the platform pre-fills the processing activities that are standard for your type of business. Each activity comes with the purpose, legal basis, data categories, typical retention periods, and common recipients already filled in.
This is not guesswork. These foundations are built from regulatory guidance, sector-specific codes of conduct, and practical experience with thousands of businesses.
Layer 2: AI scan results
When you scan your website, GDPRWise detects the actual tools, scripts, and data collection points active on your site. Google Analytics? That is a processing activity. A contact form collecting names and email addresses? Another one. A newsletter sign-up via Mailchimp? Added to the register.
The AI scan translates each finding into a concrete register entry with the relevant details filled in. You don’t have to figure out that “Google Analytics loads a _ga cookie” means “you process IP addresses and browsing behaviour of website visitors for the purpose of web analytics, with consent as the legal basis.”
GDPRWise does that translation for you.
Layer 3: Guided refinement
Your website tells part of the story, but not the full picture. You probably also process personal data offline or through internal systems: employee records in your HR software, customer files in your CRM, invoices in your accounting system.
GDPRWise asks targeted questions to identify these additional activities. The questions are specific to your sector and the findings from your scan. A restaurant gets questions about reservation systems and CCTV. A consultancy firm gets questions about client files and project data. You are not asked about things that don’t apply to you.
Your answers are translated into register entries, completing the picture.
Confidence labels: know what’s verified
One of the biggest frustrations with auto-generated documents is uncertainty. “Is this correct? Can I trust it? Do I need to check everything?”
GDPRWise addresses this with confidence labels on every entry in your register:
Detected - This processing activity was identified by the scan with high certainty. The tool, data type, and purpose are confirmed. You can trust this entry without further action.
Needs review - This entry is based on your sector foundation or your answers, but requires verification. Perhaps the retention period is a default that may not match your specific policy, or the recipients list may need updating.
These labels give you clarity. You know exactly where to spend your time and where the register is already solid. Instead of reviewing hundreds of fields, you focus only on the items that need your attention.
What your register contains
Every processing activity in your register includes the fields required under Article 30 of the GDPR:
- Purpose of processing - why you process this data (e.g., “managing customer orders”)
- Legal basis - on what ground the processing is permitted (e.g., contract performance, legitimate interest, consent)
- Categories of personal data - what data is involved (e.g., name, email, payment details)
- Categories of data subjects - whose data it is (e.g., customers, employees, website visitors)
- Recipients - who receives the data (e.g., payment processor, email marketing platform, accountant)
- Retention periods - how long you keep the data
- Security measures - how the data is protected
- Transfers to third countries - whether data leaves the EU/EEA
GDPRWise fills in as much as possible automatically. Where the platform is uncertain, it provides suggestions with explanations so you can make an informed choice.
Export in professional formats
Your register needs to be shareable. The supervisory authority may request it. Your accountant might need it. An auditor could ask for it during a certification process.
GDPRWise lets you export your register in two formats:
- PDF - A professionally formatted document, structured and clearly laid out. Ready to present to an inspector or include in your compliance documentation.
- Excel - An editable spreadsheet, useful for internal collaboration, further analysis, or integration with other management systems.
Both exports always reflect the latest version of your register, including all customizations you’ve made.
Keeping it current with continuous monitoring
A processing register is not a one-time document. When you add a new tool to your website, switch payment providers, or start a new marketing campaign, your register needs updating.
With the Peace of Mind subscription, GDPRWise rescans your website periodically and compares the results with your existing register. New processing activities show up as suggestions. Discontinued activities are flagged for removal. Changes to existing tools or scripts are highlighted.
You receive a clear overview of what changed and what needs your attention. No need to remember to review your register manually. No risk of it becoming outdated without you noticing.
Why this matters for your business
The processing register is not just a compliance checkbox. It is the document that proves you understand your own data flows. When a customer asks what data you have about them, the register tells you where to look. When you evaluate a new tool, the register helps you assess the privacy impact. When something goes wrong, the register shows the supervisory authority that you had your house in order.
Creating that register should not take weeks of manual work. With GDPRWise’s three-layer model, confidence labels, and continuous monitoring, you get a complete, accurate, and maintainable register in a fraction of the time.
Start a free scan and see how GDPRWise's three-layer model builds your record of processing activities. Sector data, scan results, and your answers - combined into a complete register with confidence labels.