What is a record of processing activities, and do I need one?

A written inventory of what personal data you hold and why. Yes, you need one.

A record of processing activities, usually shortened to RoPA, is a written inventory of what personal data your organisation holds, why it holds it, where it is stored, who it is shared with and how long it is kept.

It is the document the Commissioner is most likely to ask for first, because everything else follows from it. You cannot honestly answer a data subject request, set a retention period or assess a breach if you do not know what you hold.

Building it is mostly an interviewing exercise: each department knows its own systems. Priva gives you a link you can send to department heads so they can describe their own records without needing an account, and assembles the answers into a single register.