Technical Note No. 33/2022, published by the Brazilian Data Protection Authority (ANPD), proposes a template for a Record of Personal Data Processing Activities (ROPA) for small processing agents, whether controllers or processors.
The proposed template is under public consultation until December 4, 2022, with a definitive version expected to be published in 2023.
ROPA is mandatory under the Brazilian General Data Protection Law (LGPD), for all processing agents in accordance with its Article 37. However, among the various exceptions and exemptions to small processing agents, a simplified ROPA may be adopted, as provided for in Resolution CD/ANPD No. 2/2021.