Extract to table

As a core element of the accountability principle enshrined in Article 5(2) of both instruments, the ROPA must be kept accurate, complete, and up to date at all times

The ROPA is not merely a static record produced at a point in time; it is a dynamic reflection of NTP's processing landscape and must evolve as that landscape changes

Where any conflict arises between this guidance note and applicable law or regulatory guidance, the requirements of applicable law and regulatory guidance shall prevail

In such cases, NTP must maintain processor records in addition to controller records

1 Mandatory Fields Under Article 30(1) Each entry in the ROPA must contain, as a minimum, the information prescribed by Article 30(1)(a) through (g) of the UK GDPR and the EU GDPR

The following paragraphs describe each mandatory field and the standard to which it must be completed for NTP's purposes