Processing activities (ROPA)
The record of processing activities, how it derives from the business process, and what the Findings column means.
What an activity is
A processing activity describes an operation on personal data: which data, for what purpose, under which legal basis, for how long, and with which security measures. Taken together they are your ROPA, the record Brazilian data protection law requires of both controller and processor.
It derives from the process
The activity is born from an already-mapped business process rather than from a registry of its own. That choice avoids two inventories of the same operation: when the area changes the process, the processing activity does not linger describing a world that no longer exists.
Suppliers linked to the activity
Suppliers processing data on your behalf are linked to the corresponding activity. That link is what lets you answer who touches each data set without leaving the platform, and it is what connects a supplier's assessment to the privacy consequence it carries.
The Findings column
Each activity shows how many compliance findings the rules engine found in it. One reading detail matters a great deal here: a never-evaluated activity does not show zero. Zero means evaluated and clean; not evaluated shows as not evaluated.
The distinction exists because the opposite already happened. The platform displayed 18 activities and no findings while the undefined-retention rule was true for all 18 — the engine simply could not see activities created through the form. Zero and not-evaluated tell opposite stories and cannot collapse into one symbol.