Frequently asked questions

Yes, in almost every case. Article 30(5) exempts organisations under 250 employees, but the exemption disappears as soon as the processing is not occasional, may pose a risk to individuals, or involves special categories of data. Payroll, customer files and recruitment are regular processing activities: in practice, nearly every SME must keep a record.

A missing record falls under Article 83(4): up to €10,000,000 or 2% of total worldwide annual turnover, whichever is higher. In practice, a supervisory authority asks for the record first: not being able to produce it turns a routine inspection into an enforcement procedure.

The controller record (Article 30(1)) describes your own processing: purposes, categories of data and data subjects, recipients, transfers, retention, security. The processor record (Article 30(2)) describes the categories of processing carried out on behalf of each client controller. An agency or a SaaS vendor keeps both.

Seven items, listed in Article 30(1): identity and contact details of the controller and DPO, purposes, categories of data subjects and personal data, categories of recipients, non-EU transfers and their safeguards, envisaged erasure deadlines, and a general description of security measures.

No. It removes the mechanical work — inventorying tools, finding the vendor, hosting country, transfer mechanism and DPA — and produces a presentable register. Judgment calls (lawful basis, minimisation, actual retention, impact assessments) stay human. It is a compliance aid, not legal advice.

Three cases. The vendor is certified under the EU-US Data Privacy Framework: the transfer is lawful while the certification is active — verify it on dataprivacyframework.gov and record the date. It is not certified: you need signed standard contractual clauses and, in principle, a transfer impact assessment. The mechanism is unknown: ask the vendor in writing before entering anything in the register.

Never. The extension ships no content script. Only the domain name of the active tab is compared, in memory, against a built-in catalog. Unknown domains leave no trace, no full URL is stored, and nothing is sent to a server: the register lives in your browser's local storage.

Yes, and the free tier stands on its own: unlimited detection, unlimited processing records, unlimited CSV and JSON exports, compliance score and transfer alerts. Paid tiers (Solo €19/month, Agency €49/month) unlock proof: audit-ready PDF register, DPA tracking with reminders, disclosure generator, timestamped history and — in Agency — multi-organisation and white-label.

Yes. On your first PDF export, the free tier opens the complete register as a watermarked preview: you see exactly the document you would buy. One click starts the 14-day trial, no card required, which removes the watermark and unlocks DPA tracking, disclosures and history.

In chrome.storage — inside your browser, on your machine. The RoPA Pilot backend only ever knows an opaque licence key (no email address, no register content) and, if you subscribe, a Stripe customer id. Payments are handled entirely by Stripe.

The free tier exports to CSV (Excel, LibreOffice) and JSON (full, re-importable backup). The Solo tier adds the printable Article 30 register: cover page with the controller block, table of contents, one card per processing activity, running header and footer.

Google Chrome and recent Chromium browsers (Edge, Brave, Vivaldi), in Manifest V3. The interface follows the browser language, in English or French.