What are records of processing?
Records of processing activities (GDPR Art. 30, “ROPA”; in Turkish practice the kişisel veri işleme envanteri) are the structured inventory of everything an organisation does with personal data: which processes handle which data categories, about whom, for which purposes, on which legal basis, shared with whom, transferred where, kept how long, protected how. It is the backbone document: every other privacy artefact (notices, consents, VERBİS entries, DPIAs) should reconcile to it.
The Turkish twist: the envanter feeds VERBİS
Under KVKK secondary regulation, controllers subject to VERBİS registration must keep a processing inventory, and the categories they declare publicly in VERBİS are drawn from it. That creates a consistency trap unique to Türkiye: when the inventory, the VERBİS record and the aydınlatma text diverge: a new analytics vendor in production but not in any of the three: each gap is separately citable. The inventory also anchors retention: the destruction policy’s periods must trace back to inventory lines.
Building one that survives audits
Three principles. Inventory processes, not databases: “candidate recruitment,” “support ticketing,” “model training,” each with its data, basis and recipients; systems change faster than purposes. Assign owners: a living document needs a name per line, and quarterly diffs against the subprocessor list. And write it for two readers at once: the regulator (completeness, bases) and your future diligence team (the inventory is the first privacy document buyers request, and its absence is itself a finding).
Is a ROPA mandatory for startups?
Under GDPR the Art. 30 duty applies broadly once processing is non-occasional or risky; under KVKK the envanter obligation binds VERBİS-registered controllers, but every company that will ever face diligence should keep one regardless.
ROPA vs. DPIA?
The ROPA maps everything at inventory level; a DPIA is a deep risk assessment of one high-risk processing. The ROPA tells you where DPIAs are needed.
Related: VERBİS, data processor.
Sources. Regulation (EU) 2016/679 (GDPR) and Law No. 6698 on the Protection of Personal Data (KVKK). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.