LGPD ROPA: How to Build a Record of Processing Activities

What Article 37 Actually Requires

That sentence is short, but its operational impact is broad. A company cannot maintain a meaningful processing record if it does not know which processes, systems, data subjects, data categories, purposes, recipients and vendors are involved.

Article 37 also matters because it connects with other LGPD obligations: Article 6 principles, Article 7 and Article 11 legal bases, Articles 15–16 retention, Article 18 rights, Article 33 international transfers, Article 38 impact assessments, Article 39 controller instructions to operators, Article 46 security and Article 50 privacy governance.

Is “ROPA” an Official LGPD Term?

Not in the statutory text. The LGPD uses the concept of registro das operações de tratamento de dados pessoais— records of personal-data processing operations.

“ROPA,” short for Record of Processing Activities, is widely used as practical privacy terminology. It is convenient, especially for global organizations familiar with GDPR compliance, but Brazilian teams should not assume that every GDPR Article 30 field, exemption or interpretation automatically applies to the LGPD.

This distinction also matters for SEO and AI accuracy: it is safer to say “Article 37 requires processing records; a ROPA is a practical way to structure them” than to claim that the Brazilian statute contains a detailed “ROPA form.”

ANPD's Simplified ROPA for Small Processing Agents

Resolution CD/ANPD No. 2/2022 created differentiated rules for qualifying agentes de tratamento de pequeno porte (ATPP), or small processing agents. Article 9 says qualifying ATPPs may comply with the Article 37 record obligation in simplified form.

ANPD later published an official simplified model. The Agency said the model contains only the fields considered essential for its inspection team to obtain basic information from qualifying small agents.

The official simplified model has eight field groups

This official model is especially useful because it shows what ANPD considers essential for a simplified record: who, whose data, which data, why, under which legal basis, who receives it, how it is protected and how long it is kept.

Can every small company use the simplified model?

No. Resolution 2 defines small processing agents, but Article 3 excludes certain agents from the differentiated treatment. An agent cannot rely on the simplified treatment where, among other conditions, it performs high-risk processing, exceeds the applicable revenue threshold or belongs to an economic group whose global revenue exceeds the relevant threshold.

The regulation defines high-risk processing through a cumulative combination of at least one general and one specific criterion, including factors such as large scale or significant effects on rights combined with emerging technology, public-area surveillance, solely automated decisions/profiling, or sensitive data / data of children, adolescents or elderly people.

Article 16 of the same regulation also allows ANPD to require a small agent to comply with obligations that were otherwise waived or simplified, based on circumstances such as the nature or volume of processing and risks to data subjects.

What Should a Full LGPD ROPA Contain?

For organizations that do not qualify for the simplified model—or that simply need more operational detail— Article 37 does not provide one universal statutory field list.

The following is therefore an implementation framework, not a claim that every field below is expressly mandated by Article 37. It is designed to make the processing record useful across the rest of the LGPD program.

How to Build an LGPD ROPA: 10-Step Method

Controller ROPA vs Operator ROPA

Article 37 expressly names both controllers and operators. Their records overlap, but the operational emphasis can differ.

Legitimate Interest and the ROPA

Article 37 specifically emphasizes recordkeeping when legitimate interest is used. ANPD's legitimate-interest guidance reinforces the value of documenting the balancing analysis and the elements that support purpose, necessity, expectations, rights and safeguards.

A strong ROPA entry can therefore link directly to a separate Legitimate Interest Assessment instead of trying to compress the entire balancing test into one spreadsheet cell.

See Legitimate Interest Under LGPD: When Can Your Business Use It?.

ROPA and International Transfers

If an activity involves foreign hosting, overseas support or international vendors, the ROPA should connect to the transfer record. Resolution 19/2024 requires international transfers within its scope to be supported by an applicable LGPD legal basis and a valid Article 33 transfer mechanism.

Useful transfer fields include exporter, importer, destination country, purpose, data categories, legal basis, mechanism, subprocessors and the public transparency information required for the transfer.

See LGPD International Data Transfers.

ROPA and Retention

A ROPA becomes much more useful when every processing activity has an end-of-life rule. Articles 15 and 16 govern termination and permitted retention of personal data.

Replace vague statements such as “retain as necessary” with a measurable rule where possible:

• until the recruitment process ends plus a documented candidate-retention period;
• for the statutory accounting/tax period applicable to a record;
• for a defined security-log period based on risk and purpose;
• until contract termination plus the documented deletion/backup lifecycle; or
• until consent withdrawal where consent is the basis and no other valid retention ground applies.

ROPA and Data Subject Rights

A good processing record should help answer a very practical question: where do we search when a person exercises a right?

For each activity, record the systems and identifiers used to find data—email, customer ID, employee ID, account ID, ticket number or another search key.

Then identify whether a vendor must also act on access, correction, deletion, blocking or export. This turns Article 18 from a policy statement into an executable workflow.

Example ROPA Entry: U.S. SaaS Company Serving Brazilian Users

The point is not to create the longest possible ROPA row. The point is to create a record that is accurate, understandable, reviewable and connected to evidence.

Common LGPD ROPA Mistakes

“ROPA is only required for legitimate interest.”

Incorrect. Article 37 applies to controllers and operators generally and says “especially” when legitimate interest is the basis.

“Only controllers need processing records.”

Incorrect. Article 37 expressly includes operators.

“We copied the GDPR Article 30 template, so Brazil is covered.”

That may be a useful starting point, but Brazilian legal bases, roles, transfer rules and ANPD guidance need to be mapped separately.

“We have one ROPA row called Customer Data.”

Too broad. Order fulfillment, support, fraud, analytics and marketing can involve different purposes, bases, vendors, retention and risks.

“The ROPA lists vendors but not their countries.”

That can make Article 33 analysis impossible. Connect recipients to actual international-processing locations and mechanisms.

“We fill it out once a year.”

A periodic review is useful, but material changes should update the record when they happen rather than waiting months for the calendar date.

“Our startup automatically gets the simplified ANPD model.”

Not necessarily. Resolution 2 contains eligibility and exclusion criteria, including high-risk processing and revenue/economic-group limits.

How to Keep the ROPA Current

The LGPD does not set one universal annual anniversary for updating processing records. Article 50, however, points governance programs toward continuous monitoring and periodic assessment.

A Practical ROPA Governance Model

For most organizations, the cleanest design is to separate three layers:

This prevents the ROPA from becoming a huge narrative document while still connecting each row to defensible evidence.