Record of Processing Activities (RoPA)
GDPR Article 30 register of what personal data you process, why, where it goes and how long you keep it.
A RoPA is a GDPR-required inventory maintained by controllers and processors. Each entry describes a processing purpose, the data categories, recipients, retention and transfers. For most SaaS startups the RoPA is a one-page spreadsheet; for larger controllers it is a living internal register regulators can request on demand.