LG Inform Plus - Record of Processing Activity (RoPA)

Transcription

1 \ LG Inform Plus - Record of Processing Activity (RoPA) - This guide shows you how to create a Record of Processing Activity (ROPA) tailored for your own Council. Date: April

2 This document outlines how to create and maintain your council s RoPA within LG Inform Plus Records Retention Tool. What is it? The RoPA is a document that organisations are required to maintain under the General Data Protection Regulation (GDPR) that came into force in May LG Inform Plus s existing Records Retention Tool describes each type of record that an English council is likely to hold to meet legal and business records management requirements. You can download a spreadsheet of pre-populated information for each record type and use this to help build the Records Retention Schedule that your council is required to hold. For GDPR, record types have been broken down in greater detail and more standard information has been pre-populated. This information forms a template RoPA which you need to supplement with your local information to form your council s full RoPA. LG Inform Plus lets you: download the template RoPA upload and download a spreadsheet of your RoPA maintain your RoPA online The RoPA tool is built by and for a community of local authorities working with the Local Government Association (LGA). Legal and records retention guidance is provided by Kent County Council and delivered via the Records Retention and RoPA Tools. We expect tools and data to be refined as experience builds up across the community of local authorities. Your record managers and legal team should use the data provided as a guide but you MUST ensure that your own council s experts review and approve your retention schedule and RoPA. 2

3 Download the template RoPA Follow these instructions to get a RoPA that has generic record type information prepopulated but contains empty fields for information that is specific to your council. 1. Go to Records Retention Go to the front page of LG Inform Plus (lginformplus.local.gov.uk ) and click on the Records retention icon or got directly to the Records Retention tool at retention.lginformplus.local.gov.uk 2. Select retention guidance and sign in Select the retention guidance option on the left and sign in. 3

4 If you have not previously registered, use the Register option first to register with your council address. Your council needs to be subscribed with LG Inform Plus to use this tool. If you don t have access after sign in, contact lginformplus@local.gov.uk or the support team at support@esd.org.uk. 3. Select business function and download template RoPA Following sign in you will see the retention guidance listed. There are options to filter this for types of record and organisation type (e.g. County, District, Unitary, Fire authority). Against Business function, pick the functional area for which you want record types, or leave it at everything for the full RoPA. Note that you can pick a sub-function as well for a very specific functional area if you wish. Next click on the Download RoPA template button. After a few moments, a file named RoPA.csv will be downloaded to your computer. This is a comma separated values file that can be opened by a spreadsheet tool such as Microsoft Excel. If you are maintaining your own RoPA offline, you can use this CSV file to input to your RoPA. If you are using LG Inform Plus to maintain your RoPA, progress to the next section of this guide. 4

5 Edit RoPA offline and upload changes 1. Edit the CSV file using a spreadsheet tool Open the RoPA.csv file that you have downloaded from the Download RoPA template option described above or from a subsequent download of your own RoPA. You can use Microsoft Excel, Google Sheets or any other spreadsheet package that lets you open a CSV file, edit it and save it back in CSV format. The CSV spreadsheet has columns A to AR as listed here: Column Column heading Notes A OrganisationName Columns that apply to your whole organisation. You need only fill in the B DataControllerName first row C DataController D DataControllerAddress E DataControllerTelephone F DataProtectionOfficerName G DataProtectionOfficer H DataProtectionOfficerAddress I DataProtectionOfficerTelephone J ROPAID RoPA identifier that is assigned automatically to a new entry and used to identify an existing entry that you are editing or deleting. Invalid identifiers are ignored. K RetentionID Records retention record type identifier, which indicates where data for the prepopulated fields comes from 5

6 L BusinessFunction Pre-populated business function name that you can change if you have a strong preference for using your own function names M ServiceID (download only) Columns that are pre-populated according to the record type and N ServiceName (download only) cannot be changed O P Q R S T ServiceLegislationName (download only) ServiceLegislationPowerOrDuty (download only) RecordsDescription (download only) ContainsPersonalInformation? (download only) ContainsSpecialInformation? (download only) ImpactLevel (download only) U V W X LegalOrBusinessRequirement? (download only) RetentionLegislationName (download only) RetentionLegislationURL (download only) RetainPermanently? (download only) Y RetentionRequirements Retention requirements pre-populated from the guidance. You can change this locally if you wish Z Notes (download only) Columns that are pre-populated according to the record type and AA AddedDate (download only) cannot be changed 6

7 AB UpdatedDate (download only) AC DataProcessingName Columns that describe your own RoPA records. These should be filled in by AD DataProcessing you in the spreadsheet and/or online. AE DataProcessingAddress AF DataProcessingTelephone AG ProcessingPurpose AH JointProcessorName AI CategoriesOfIndividual AJ CategoriesOfPersonalInformation AK CategoriesOfRecipients AL ContractLink AM DetailsOfTransfer AN Safeguards AO SecurityMeasures AP TimeLimits AQ LegalBasisForProcessing AR Delete Enter yes here if you want to delete the RoPA record identified by the ROPAID column. All other values are ignored. You can populate the category fields with any text values that you wish, but these are the standard lists of values offered. Use the standard categories unless your organisation has agreed different values for good reason. 7

8 Categories of individual Employees Customers Members Patients Pupils Categories of personal information Contact details Health data Financial information Employment data Education data Race Ethnic origin Politics Religion Trade Union membership Genetics Biometrics (where used for ID purposes) Health Sex life Sexual orientation Categories of recipients Suppliers Credit reference agencies Government departments Court and police services Banks and insurance companies If more than one category applies for a single RoPA record, put a symbol between each category. For example xxxxx yyyyy. The is known as a pipe symbol. It usually comes above the \ at the bottom left of a PC keyboard. Two rows of a completed sample RoPA spreadsheet are shown below: 8

9 2. Upload the RoPA Select the RoPA option at the left of the page and click on the Upload RoPA button. Choose your file of edited RoPA records and click upload to upload it for storage, viewing and editing online. After upload, this message will appear: Keep an eye on your inbox for a message from support@esd.org.uk telling you that your upload is complete as shown below: 9

10 Following successful import, you can refresh or go back to the RoPA page which will show the records that have been imported. 10

11 Note that the Download button now presents three options: In addition to the RoPA template, there are CSV download options for: YourCouncil RoPA - this has one row for each record that you have added to your RoPA. Template populated with YourCouncil RoPA - this has one row for each record that you have added to your RoPA plus a row for every record type (matching your filtered options) so you can see what other RoPA records might be needed. 3. Points to note on CSV editing and upload You need only provide organisation details in columns A to I on the first row of data, that is row 2 of the spreadsheet If you leave the ROPAID column empty on a row, a new RoPA record will be added on upload provided at least one of the columns of local information (columns AC to AQ) is filled in If you want more than one record of the same record type, simply duplicate a row in the spreadsheet with the same RetentionID If you fill in the ROPAID column your existing RoPA record with that identifier will be edited on upload Columns expecting a Boolean value will accept the values yes and no which are not case sensitive. An empty value is also accepted where the field is not mandatory. Editing your RoPA online You can view and edit your RoPA online. You can also edit and delete records there or, via further spreadsheet download, edit and upload operations. 1. View the RoPA online Select the RoPA option from the left of the screen to see your council s RoPA. 11

12 If you wish, you can use the filters to limit what you see to RoPA records for a single business function, a single processing officer and just for records that have personal or special data. Click on a record type heading to see details of the corresponding RoPA record. 12

13 2. View and edit a RoPA record When you have selected a record from the RoPA, it will show in a separate page.. Use the button to provide details of the record type. These cannot be changed and are hidden by default. Click on to hide the record type fields that you cannot change. The page that then displays contains boxes for the organisation s data controller and data protection officer followed by controls in which you can edit values specific to the RoPA record selected. Note that changes made to the organisation s data controller and data protection officer apply to the whole RoPA, not just to the record shown. 13

14 Against the Business function and Retention requirements fields you will see the reset symbol, if the value differs from the default for the record type when the page is loaded. Click on this once to go back to the default for the record type. Click on it again if you want to revert to the value that you had when the page was loaded. The control will appear when you leave one of these fields, having changed from the default to your own value. 14

15 At the bottom of the page are save and cancel buttons. Click on these buttons to return to the RoPA list page after saving or abandoning your edits. 3. Add a new RoPA record From the RoPA page, use the button to add a new RoPA record. Firstly you will be asked to select the record type applicable. Start adding the record type description to find a list of matching record types, from which you can select one. Then click create and you will be taken to the RoPA record page described above where you can fill in details for the new RoPA record. 15

16 Generating a Privacy Notice From the page showing a RoPA record in detail, click on the Privacy notice button to generate a privacy notice. If your council has customised privacy notice templates, you will be asked to select one. If not, you will be taken straight to the default template called Default privacy notice. 16

17 The privacy notice is displayed as formatted text with variables replaced by values from your selected RoPA record. A row of dots... is shown for variables that you have left blank. Some paragraphs are only shown in some conditions, e.g. where the RoPA record relates to special data. Use the print button to send the notice straight to a printer. Use copy to clipboard if you want to paste the notice elsewhere, e.g. in an message or in a word processor for further editing. The edit (advanced) button gives you access to advanced functions to edit the default template (or another template belonging to your organisation) and to save it under a new name. Editing requires a basic understanding of HTML, so, if you are unsure what to do, ask the Support Team to create RoPA templates for you. If you do edit your own template and want to include an image (e.g. your logo), that should be uploaded to File Exchange and referenced from there. Accessing RoPA from Record Retention pages The main Retention guidance page lists record types with suggested retention details. For each record type you can see what RoPA records exist and add new ones. Record types for which you have no RoPA records are shown with the icon. Clicking on this icon takes you straight to a RoPA detail page where you can add a new RoPA record as described above. 17

18 Record types for which you have one or more RoPA records are shown with the icon. Clicking on the icon takes you to a page listing all the RoPA records for the selected record type, as shown below: 18

19 Use the Add RoPA record button to add a further record of this type or use the Edit or Delete buttons to change or remove a selected RoPA record. 19

20 Need more help? We hope you found the introduction to the RoPA tool useful, but if you have any further questions or would like to learn more, please get in touch. Use the Help link in the navigation bar anywhere in LG Inform Plus to read through our online help guides, or send an to and the support team will get back to you (Monday Friday, 9 a.m. to 5.30 p.m.). 20

21 For more information please contact Local Government Association 18 Smith Square London SW1P 3HZ Contact the Local Government Association Telephone: Website: Local Government Association, 2018 For a copy in Braille, Welsh, larger print or audio, please contact us on We consider all requests on an individual basis. 21