Differences between IAR and RoPA

Your organisation can choose to use the IAR/RoPA tool to create and maintain either an online Information Asset Register (IAR) or an online Record of Processing Activity (RoPA) or to create and maintain both of them together.

An IAR is a simple way for an organisation to manage the information assets they hold and identify any risks to them.  It helps identify areas of duplication and encourages greater efficiency.  Typically an information asset register will hold details of each asset describing the asset, it’s location, ownership, significance to the organisation and whether or not an asset may contain any personal data.

Every organisation is required to keep a RoPA as part of the Data Protection Act 2018.  A RoPA is also a record of information assets the organisation ‘processes’ but a RoPA only contains details of any data or records (information assets) which contain any personal data.  The information to be held for each RoPA entry is stipulated in GDPR regulations and includes details of officers responsible for Data Protection and Data Control for the organisation and details of the personal data contained within the records, those responsible for the processing and the legal basis for the processing.

If your organisation chooses to use LG Inform Plus to keep both the IAR and the RoPA then it can represent a saving in effort to create and maintain both as much of the information held is common to both registers.  When you add a new record you simply need to state whether the record belongs to IAR, RoPA or both.