> ## Documentation Index > Fetch the complete documentation index at: https://docs.assuric.com/llms.txt > Use this file to discover all available pages before exploring further. # Data processing and DPIAs > Your Records of Processing Activities (RoPA) under GDPR Article 30, built from the suppliers and assets you've already added, and the DPIA template you attach to an activity. **Quick summary** * The **Data Processing** register is your RoPA, the record GDPR's Article 30 requires. * DPIAs aren't in this register: generate one from a template under **Documents → Templates**, then attach it to its activity. Where data leaves the UK, the transfer mechanism isn't optional in practice, though the field lets you skip it: a processing record showing an international transfer with none recorded is a finding waiting to happen. ## Add a processing activity Click **Privacy & Security** in the sidebar, then **Data Processing**. *Suggested Activities* offers supplier-derived purposes and generic ones covering payroll, recruitment, marketing and more. Click **Add** on one that fits, or **Add Activity** to describe your own. Enter the *Activity* name and description, set the *Role* (*Data Controller* or *Data Processor*), and link the *Information Asset* it uses. The Data Processing Activities register listing processing activities with Role and Information Assets columns

The Data Processing Activities register listing processing activities with Role and Information Assets columns

Add data subjects, data categories, the legal basis and a retention period. Flag *Third Country Transfers* too, because it's the field the warning above is about. A processing activity's detail view with the Third Country Transfers checkbox, Article 6 Lawful Basis and Retention Period highlighted

A processing activity's detail view with the Third Country Transfers checkbox, Article 6 Lawful Basis and Retention Period highlighted

Both are optional but worth completing: *Related documents*, such as a data protection impact assessment ([DPIA](#generate-a-dpia)) or a retention schedule, and the *security measures* protecting the processing. ## Generate a DPIA Assuric has no DPIA register: you create a DPIA as a regular document from its template. In **Documents**, open the **Templates** tab, search *Data Protection Impact* and find *\[TEMPLATE] Data Protection Impact Assessment - Supplier* under *Assuric Templates*. The Documents Templates tab showing the search box and the matching DPIA template row under Assuric Templates

The Documents Templates tab showing the search box and the matching DPIA template row under Assuric Templates

On that row, click **Create from template** and fill in the dialog as for [any document](/documents/creating-a-document#fill-in-the-document-details). The document type and frameworks come pre-filled. The Create from Template dialog showing document title, description, controlled toggle, owners, document type, categories, folder, products and frameworks fields

The Create from Template dialog showing document title, description, controlled toggle, owners, document type, categories, folder, products and frameworks fields

Work through the new DPIA in your **Documents** list, then attach it to its activity as a related document. **What we recommend** Add your suppliers first, so the suggestions above fill in most of the register. Then keep it to activities that involve personal data, as your supplier list includes things that never touch it. ## Related articles What this register's activities link to. Where a supplier-derived suggestion comes from. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.