The Records of Processing Activities (ROPA) is mandatory under GDPR Article 30 for any organization that processes personal data. It documents every processing activity with its purpose, legal basis, categories of data subjects, recipients, and retention periods. In an ISMS, the ROPA overlaps with the asset register and the data classification scheme. Maintaining both registers in an integrated way saves effort and ensures consistency. Supervisory authorities can request the ROPA at any time.