Processing Activities

Know what you do with personal data, and be able to show it.

A processing activity is a record of one thing your product does with personal data, and why. Avaril helps you build those records from what you already have, and keeps them true as your product changes.

Processing activities

Turn every use of personal data into a structured record.

A processing activity captures one thing your organisation does with personal data, for a defined purpose. Record what data is involved, whose data it is, why it is processed, who receives it, how long it is kept, and how it is protected.

One processing activity

Send order confirmation emails

Data subjects: Customers
Data categories: Name, email address, order details
Purpose: Confirm and fulfil the customer's order
Legal basis: Legitimate use · s.7(a)

Recipients: Email delivery provider
International transfers: United StatesSafeguards documented
Retention: 30 days after order completion
Security measures: Encryption in transit · Access controls

DPDPA governance

Privacy Governance, Built Around Your Data

Understand what the DPDP Act expects from your organisation, starting from transparent data collection and purpose-specific consent to retention and deletion. Build a clear picture of how personal data moves through your systems, why it is processed, and when it must be deleted, turning regulatory obligations into actionable privacy governance.

Data collected

EmailRequired

PhoneRequired

Date of birthOptional

Purpose

Account creationService delivery

Make every data collection purpose clear

Tell people what personal data you collect, why you collect it, and the information they need to understand your processing.

Data categoriesProcessing purpose

DPDPA s.5(1) · Rule 3

Consent

PurposeAccount creation

Data requested

NameEmailPhone

Consent recorded

Keep consent specific to the purpose

Consent should be tied to a defined purpose and limited to the personal data necessary for that purpose.

PurposeLegal basisData required

DPDPA s.4(1) · s.6(1) · s.7

Collect

Use

Retain12 months

Delete

Know when personal data should leave your systems

Define how long data needs to be retained and what happens when the purpose is fulfilled or consent is withdrawn.

Retention periodDeletion action

DPDPA s.8(7)

Your organisation

Database

Analytics

Payment provider

DPA

Know who processes data on your behalf

Keep processors under valid contractual arrangements and maintain visibility into the vendors handling personal data.

VendorsDPA statusProcessing relationship

DPDPA s.8(1) · s.8(2)

Child data

Children's dataDetected

Parental consentRequired

Targeted advertisingRestricted

TrackingRestricted

Apply stronger controls when children are involved

Verify parental consent where required and prevent prohibited tracking or targeted advertising involving children.

Children's dataParental consentRestrictions

DPDPA s.9(1) · s.9(3)

Data request

Processing activitiesAccount managementAnalyticsSupport

Shared withAnalytics providerCloud provider

Be ready to explain how personal data is being used

People may ask about the processing of their personal data and the entities with whom it has been shared.

Processing activitiesVendorsData disclosures

DPDPA s.11(1)

Most of these duties are expected to start around May 2027, eighteen months after the Rules were notified on 13 November 2025. Sections refer to the Digital Personal Data Protection Act, 2023. Some duties have exceptions, such as retention where a law requires it and the exemptions the Rules prescribe under section 9.

Start from whatever you have

You don’t begin with a blank spreadsheet. Pick the way in that fits where you are.

No time to start from scratch
Avaril Exchange
Pick from activities Avaril has curated and add them to your record.
You already have a privacy policy
AI Extract
Uses AI
Upload a policy PDF or image, or describe your product. An AI model drafts activities for you to review.
You want to be guided
Questionnaire
Answer plain-language questions, like “Does your product have a login screen?”, and get matching activities.
Your vendors send paperwork
Imports
Read a vendor’s DPA PDF (parsed by rules, no AI), or load a RoPA Passport file.
You want full control
Add manually
Fill in every field yourself.

Connected, not a spreadsheet

The record is linked to the code, data, vendors and retention it describes.

The record

Processing activity

Your code

The Python SDK lets a function name the process it implements, using the same ID as your workspace. Your workspace exports its declared processes for the SDK to read.

@avaril.process(
  id="proc_consent",
  client=client,
)
def handle_signup(request):
    ...

Data assets

The data stored for this purpose is bound to the activity.

Vendors

Who touches the data, and whether a DPA is in place.

Retention

How long the data is kept, why, and what happens at the end.

Enforce the privacy regulatory rules in your software.

Processing activities aren't just records in a workspace. Declare them in code with the SDK, then let the CLI catch the moment your software drifts from what's declared.

import avaril
from avaril import AvarilClient
from .services import LoginService
client = AvarilClient(publishable_key="av_pk_live_...")
service = LoginService()
@avaril.process(id="authentication_process", client=client)
def handle_login(request):
    avaril.consent_trigger()
    response = service.function_login(request)
    avaril.retain(request.id)
@avaril.process(id="authentication_signout_process",client=client)
def signout(request):
    avaril.consent_trigger()
    service.function_signout(request)
    avaril.deletion_trigger(request.id)

Declare privacy where the data is processed

Define processing activities directly in your application code. Associate workflows with the data they handle, the purpose of processing, and the privacy controls that should apply—creating a structured representation of what your software actually does.

Detect privacy drift before it reaches production

Compare what your application declares with what has been deployed. Use Avaril's CLI to validate processing definitions, identify unexpected changes, and surface privacy drift before it becomes an operational or compliance problem.

Graphical editor

A visual operating map for your processing activities.

Transform processing records into an interactive graph of actors, activities, systems, data flows, and legal bases. Avaril keeps the visual model continuously aligned with the underlying records as your processing environment evolves.

Visualize

Every activity becomes a node, connected to the actors who trigger it and the legal basis it relies on — laid out automatically, no manual diagramming.

Trace

Follow a data flow from an actor through to the lawful ground it's processed under, with a legend and minimap for workspaces with dozens of activities.

Export

Pull the diagram out for an audit, a DPIA, or a board update, without reaching for a separate diagramming tool.

Avaril's graphical editor rendering a RoPA as an interactive use-case diagram, with actors, processing activities and their legal basis connected and auto-laid-out

Take your record with you

A RoPA Passport is one encrypted file holding a set of activities. Import it into another workspace to start from a known baseline, or hand it to an advisor.

Encrypted with AES-256-GCM, using a passphrase you choose (12+ characters). Avaril never stores it.
Signed with Ed25519. A passport signed by Avaril’s platform key imports as Verified; any other imports as Unverified.
Imports open as a preview first. Nothing is written until you confirm.
Every export is logged in your export history.

Limited Beta Access

Build Privacy Governing Workflows Faster business-ready?

Built for Startups and MSMEs navigating Privacy legal compliance, privacy operations, and consent management at scale.

No spam, ever. We'll only send you product updates.

Request Feature Join Discord Community View Roadmap