ROPA for Live Chat: Record of Processing Activities

A ROPA for live chat, short for record of processing activities, is the short document that says what personal data your chat collects, why, who sees it and how long you keep it. Under the GDPR most organisations must keep such a record, and a chat widget is one of the places where personal data enters your business every day: names, e-mail addresses, free text and technical details. This guide explains what Article 30 asks for, shows a filled-in example for a live chat and lists the gaps that usually turn up when someone finally checks.

Talkmio is an AI live chat for websites. Its assistant, Mio, answers visitors from your content and hands the conversation to your team when it cannot answer. The guide is practical, not legal advice. Your record must describe your own processing, and a data protection officer or lawyer should review it where the stakes are high.

What a ROPA Is and What Article 30 Requires

A record of processing activities, often shortened to ROPA, is a written inventory of your processing. Article 30 of the GDPR sets out what it must contain, and the text is available in the full wording of Article 30. For a controller, which is the role of the business that runs the website, the record lists:

the name and contact details of the controller and, where relevant, the data protection officer;
the purposes of the processing;
the categories of people and the categories of personal data;
the categories of recipients, including those outside the EU;
transfers to other countries and the safeguards used, where applicable;
the planned time limits for erasure, where possible;
a general description of the technical and organisational security measures, where possible.

Processors, such as a company that hosts a chat service for you, keep a shorter record of their own. The record must be in writing, which includes electronic form, and you must show it to the supervisory authority on request. It is not published, and it is not the same as your privacy notice, although the two should agree with each other.

Do You Need a ROPA for Live Chat?

There is an exemption for organisations with fewer than 250 employees, but it is narrow. It does not apply if the processing is likely to result in a risk to people, if it is not occasional or if it includes sensitive categories of data. A live chat runs every day, so it is not occasional. In practice, even small businesses are safer keeping a record. The UK regulator’s guidance on documentation says much the same, and it also notes that a good record helps you answer other questions later, such as a request from a customer to see their data.

There is also a business benefit. When a customer, an auditor or a big client sends a security questionnaire, the answers are already in your record. Our guide to the GDPR and live chat covers the wider rules, and this article concentrates on the one document you should be able to produce in minutes.

ROPA for Live Chat: Example Entry

The table below shows how one entry for a website chat might look. Adapt every line to your own situation, because the purposes, recipients and retention you choose are yours to decide and justify.

Field	Example for a website live chat
Processing activity	Website live chat and support tickets
Controller	Your company name, address and privacy contact
Purposes	Answering visitor questions, customer support, handling complaints, improving help content
Categories of people	Website visitors, customers, prospects, your own staff who use the Inbox
Categories of data	Name and e-mail if given, message text, ticket details, IP address, country, device, page visited, source
Special categories	Not requested; customers may mention them in free text, so add a notice asking visitors not to share them
Recipients	Your support team; the chat provider as processor; the AI model provider as its sub-processor
Transfers outside the EU	Check the provider’s data processing terms and state the result
Retention	Your own period, for example 12 months after the conversation closes
Security measures	Role-based access, EU hosting, encrypted connections, staff training
Legal basis	Legitimate interest in answering visitors, or steps before a contract; consent for any optional cookies

The legal basis is not a required field under Article 30, but many teams add it because they have to state it in the privacy notice anyway. Keeping everything in one place avoids contradictions.

Fill In the Hard Fields: Categories of Data

List what the chat really collects, not what you intended. Walk through a conversation from the visitor’s side. The visitor opens the widget, so the browser connects and your provider sees an IP address and device details. In the Inbox, a team member sees the country, city, page, device, browser and source of a visitor. If a pre-chat form is switched on, the form asks for a name and e-mail. If the team is offline, the visitor leaves an e-mail address. During the conversation, the visitor can type anything, including things you did not ask for, such as an order number, a health detail or a phone number.

That last point matters. You cannot prevent free text, so your record should say that visitors may enter additional data and describe what you do about it: a notice in the widget, a rule in the Business instructions, and a routine for removing data that should not be there. Also decide whether you really need a pre-chat form. Every field you remove is a line you do not have to justify.

Recipients, Processors and the AI Provider

List every party that receives chat data. Your own team is an internal recipient, and the chat service is your processor. Talkmio stores data on servers in the EU (Germany), and only the conversation text and relevant knowledge base excerpts are sent to the AI model provider that produces the answer. Your record should name the processor, describe the role of the sub-processor and point to the contract that governs them. If you have signed or accepted a data processing agreement, reference it by date. Our article on the data processing agreement for live chat explains what to look for.

Do not guess about transfers. If any party processes data outside the EU or the EEA, the record must say which safeguards apply. Read your provider’s terms, ask in writing if they are not clear, and file the answer next to the record. Talkmio support can be reached at the address on the contact page, and a written answer is better evidence than a memory.

Tickets and the e-mail channel

If you use tickets, add them to the same entry or create a second one. On Pro and above, the e-mail channel turns forwarded support mail into numbered tickets, and replies go back by e-mail in the same thread. That widens the data categories to include e-mail addresses, subject lines, message bodies and any attachments customers send, and it widens the group of people to anyone who writes to your support address. State this in the ROPA for live chat, or the record will describe only half of what the Inbox actually holds.

Retention: Say How Long and Mean It

The record asks for planned time limits for erasure where possible. A chat service can store history for as long as the plan allows, and the plans differ: Free keeps 30 days of history, Pro keeps 365 days and Ultimate and larger plans keep history without a limit. That is a technical limit, not a policy. Decide how long you actually need conversations: perhaps 12 months for support questions, longer for tickets that form part of a contract or a warranty claim, and a shorter period for chats that never became a ticket. Write the period down and apply it. Our guide to live chat data retention gives examples.

You can export or delete data at any time. That makes it practical to honour requests from customers, and the guide on data subject access requests in live chat explains how to handle them without panic.

Security Measures in Plain Words

The record needs a general description of technical and organisational measures. Do not copy a long security policy. Write five to eight lines that are true for you. For example: access to the Inbox is limited to named team members; roles separate agents, who handle conversations, from admins, who manage websites and settings; the owner handles billing; the service is hosted in the EU; connections are encrypted; and the team is trained on what to do when a customer shares sensitive information. If you use the mobile app, add that devices are protected with a screen lock and that leavers are removed from the team. Our article on encryption in live chat can help you word the technical lines.

Common Gaps Found in a ROPA for Live Chat

When someone finally reads a chat record carefully, the same gaps tend to appear. The record lists the chat provider but forgets the sub-processor that produces the AI answers. It names a purpose, such as support, but ignores that conversation text is also read to improve help pages. It states a retention period that nobody applies, because the tool keeps everything by default. It forgets the mobile app, where team members read conversations on personal phones. It ignores the second place where chat data lands: tickets created from conversations, e-mails sent when the team is offline and exports saved on a laptop.

Walk the whole path of one conversation, from the visitor’s first message to the day it is deleted, and tick every system it touches. Anything that stores the text belongs in the record, even if only for a short time. A one-page flow drawn on paper, with the widget on the left and the deletion step on the right, is often the fastest way to find the missing lines.

Keep the Record Alive

Give the record an owner, a date and a version number.
Review it twice a year and whenever you change the chat: a new channel, a new pre-chat form, a new AI feature or a new region.
Compare it with your privacy notice, because the purposes and retention periods should match.
Store it where your team can find it, and keep earlier versions.
Add a line to your onboarding checklist, so new admins know the record exists.

A record that was correct when written and wrong a year later is a common finding. The cheapest control is a calendar reminder. The same discipline pays off in the live chat privacy policy, which should always reflect what the record says.

Frequently Asked Questions

Is a record of processing activities required for live chat?

Most organisations that process personal data regularly must keep one, and a live chat processes data every day. The exemption for small organisations is narrow and does not apply to processing that is not occasional. Keeping a record is safer, and it makes questionnaires and access requests much easier to answer.

What should the record say about the chat provider?

Name the provider as a processor, describe its role, state where data is stored and list any sub-processors that receive data, such as the AI model provider. Reference the data processing terms you accepted by date, and check whether any transfer outside the EU needs safeguards.

Do I list IP addresses as personal data?

Yes. IP address, country and device details can identify a person, and they are shown in the Inbox as context for your team. Include them in the categories of data, and state the purpose, which is usually providing support and securing the service.

How long should I keep chat conversations?

Choose a period that matches your purpose and write it down. Many teams use around 12 months for ordinary support chats and longer for tickets linked to a contract or warranty. The plan’s history limit is a technical boundary, not a retention policy, so set your own rule.

Is the record the same as my privacy policy?

No. The privacy policy tells visitors what you do, in plain language. The record is an internal document for accountability, shown to the authority on request. They must agree with each other, so update both when your chat setup changes.

Who should write and own the record?

Someone who understands how the chat is used, ideally the support lead together with whoever handles privacy, such as a data protection officer. Have a lawyer review it when sensitive data is involved. Assign an owner, set a review date and keep earlier versions.

The Bottom Line

A good ROPA for live chat is short, specific and true. List the purposes, the people and data involved, the recipients, the transfers, the retention period you actually apply and the security measures you really use. Review it when the chat changes, and keep it consistent with your privacy notice. Start free with Talkmio, check the data your widget collects and write the record from what you see in the Inbox.

ROPA for Live Chat: Record of Processing Activities Explained