We must ensure control over where personal data is processed, whose data is being processed, and for what purposes the data is processed. The requirement follows from Article 30 of the General Data Protection Regulation (GDPR).
As the data controller, NIH must maintain a record that includes at least: the name and contact information of the data controller and, if applicable, the Data Protection Officer, the purposes of each processing activity, a description of the categories of data subjects and types of personal data, categories of recipients to whom the data is disclosed (including any recipients outside the EEA), planned time limits for the deletion of data, and a general description of technical and organizational security measures.
For practical reasons, NIH maintains two separate records—one for administrative processing activities and one for research projects.
RoPA for Administrative Activities - Processing List
The Processing list is stored in a dedicated Teams group. The group also contains a guide that, among other things, specifies various types of legal bases for processing. Department heads can grant their staff access to register processing activities within their area of responsibility.
Update as of July 2026: A new version of the processing list is available for the Study Department and HR. Other departments will be added.
RoPA for Research Projects
All research projects involving personal data must be reported to Sikt - Privacy Services for a data protection assessment. The total overview of reported research projects constitutes NIH's record of processing activities for research projects.
Read about the requirements for assessment with Sikt before starting a research project on the page about Procedures for Research Involving Personal Data.