ROPA, data map, asset inventory: three things that get conflated

They overlap enough to be confused and differ enough that substituting one for another leaves a gap. Here's what each answers and how they connect.

A team is told to produce a record of processing. Someone points out there is already an asset register. Someone else has a data flow diagram from a project two years ago. The question of whether these are the same thing is usually settled by whoever is most tired, and the answer is no.

What each one answers

The organising principle in the right-hand column is the whole difference. A ROPA indexed by system rather than by purpose stops being a ROPA, because the fields Article 30 asks for - purpose, lawful basis, retention - vary by purpose within a single system.

Why substitution fails

An asset inventory does not know what is in the assets

It tells you the laptop exists, who has it, and what is installed. It says nothing about whether there are payroll exports in the downloads folder. It is a list of containers, not contents.

A data map describes the design, not the state

Flow diagrams are drawn from architecture. They are accurate about the intended path and silent about the copy someone made outside it. A map showing personal data moving from the CRM to the billing system is true, and incomplete if it omits the monthly spreadsheet somebody exports for a meeting.

A ROPA does not tell you where the data physically is

Article 30(1) does not ask for storage locations directly. It asks for purposes, categories, recipients, transfers, retention and a general description of security measures. Location is implied by the last of those and is usually the least precise field in the document.

How they connect

Each supplies something the others need:

1. 1The asset inventory tells you which places to look.
2. 2Discovery tells you what personal data is actually in those places.
3. 3The data map explains how it got there and where it goes next.
4. 4The ROPA states why you have it, on what basis, and for how long.

Step two is the one most organisations do not have. Steps one, three and four are all documents describing intent; only step two is an observation. Without it, the other three can be internally consistent and collectively wrong.

If a subject access request forces you to search places your ROPA does not mention, the gap is at step two. That is the signal worth acting on.

How EmberHound fits

EmberHound produces the observation layer. It scans enrolled company devices and reports personal data by category and location, which is the evidence the other three artefacts are written against rather than a replacement for any of them.

The ROPA capability is available inside the GDPR plans, and a standalone ROPA Workspace is in early access.

This article is general information, not legal advice. Confirm the obligations that apply to your organisation before acting on it.