Use this when there is no record, when the record is a system inventory with a privacy heading, or after new products, markets or vendors changed the processing. You get two or three files in a new folder, ./ropa-first-draft/: a spreadsheet you can open in Excel listing everything the company does with personal data for its own purposes, one row per activity with its data, people, legal basis and retention (ropa-controller.csv); a second spreadsheet for the data the company handles on behalf of customers, only if it does (ropa-processor.csv); and a short note of open questions per team (ropa-notes.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Legal bases and retention periods are decisions for the controller's privacy lead or counsel; the agent proposes them.

Inputs to gather

Read before asking: the system and application inventory, the vendor list and signed data processing agreements, the privacy notice and cookie settings, the product data model or schema descriptions, HR and payroll system lists, marketing and sales tool lists, retention settings where the agent can see them, and customer contracts that make the company a processor. Ask the reader, in one message: which teams own which processing (HR, sales, marketing, support, product, finance, IT), whether the company processes data on behalf of customers, and who can confirm legal bases.

Step 1: list activities by purpose, not by system

A processing activity is a purpose with its data, people and systems: "payroll", "recruiting", "customer support tickets", "product analytics", "newsletter", "fraud screening". One system can serve several activities; one activity can span several systems. Walk team by team and list the activities. A company of 20 to 300 people usually lands at 15 to 40 controller activities. Fewer than 10 means purposes have been lumped ("business operations"); split them where the legal basis, retention or data subjects differ.

Step 2: fill each row

Article 30 of the GDPR sets out what the record covers; use it as the backbone and add the columns the rest of the programme needs. Per activity, one row of the controller spreadsheet (ropa-controller.csv):