Record of Processing Activities (ROPA)

Internal documentation a Data Fiduciary maintains listing what personal data it processes, for what purposes, with whom it is shared, and how long it is retained. Though not spelled out as a single named requirement in the Act, it is standard practice for demonstrating compliance with notice, purpose limitation, and security obligations.