Activity
Source: src/models/ropa.ts (ActivitySchema)
Activities are nested inside Ropa.ous[].activities[]. Each activity represents one GDPR processing activity (an Art. 30 record). Activity IDs are unique per Ropa document; they are assigned by incrementing Organization.highestActivityId at creation time.
Fields
Identity & timestamps
| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
activityId | Number | ✓ | — | Unique per Ropa. Assigned from Organization.highestActivityId. |
activityName | String | — | — | Max 120 chars. |
createdAt | Number | ✓ | Date.now() | Unix timestamp in milliseconds (not seconds). |
updatedAt | Number | ✓ | Date.now() | Unix timestamp in milliseconds. Must be updated manually on write. |
Purpose & legal basis
| Field | Type | Notes |
|---|---|---|
purposeShort | String | Max 512 chars. |
purposeLong | String | Max 2048 chars. |
legalbasis | String[] | Enum from legalbasisValues. Art. 6 legal bases; multiselect. |
legalbasisLong | String | Free-text clarification of the legal basis. Default "". |
legalbasisSpecial | String[] | Enum from legalbasisSpecialValues. Art. 9 special category bases; multiselect. |
Data & categories
| Field | Type | Notes |
|---|---|---|
dataCategories | String[] | Enum from dataCategoriesValues. Types of personal data processed. |
datasubjectCategories | String | Free text; describes categories of data subjects. |
activityCategories | String[] | Enum from activityCategoriesValues. Processing activity type. |
dataOrigin | String | Free text; origin of the personal data. |
timeLimit | String | Free text; data retention period. |
Parties
| Field | Type | Default | Notes |
|---|---|---|---|
controllers | Number[] | [0] | Partner organizationId values. At least one required. 0 = the org itself. All must be non-negative integers. |
processors | Number[] | [] | Partner organizationId values. May be empty. 0 = the org itself. |
controllers and processors store partner IDs, not MongoDB _ids. To resolve a party, look up Organization.partners[] where organizationId matches. 0 always resolves to Organization.selfOrganization.
Transfers & security
| Field | Type | Default | Notes |
|---|---|---|---|
transfers | Boolean | null | true if data is transferred outside the EEA. |
transfersLong | String | — | Free-text detail on international transfers. |
profiling | Boolean | null | true if the activity involves profiling or automated decision-making. |
communications | String | "" | Short description of data disclosures. |
communicationsLong | String | "" | Long description of data disclosures. |
securityLevel | String | — | Enum from securityLevelValues. |
securityMeasuresLong | String | — | Free-text description of security measures. |
Status
| Field | Type | Default | Notes |
|---|---|---|---|
active | Boolean | false | Setting to true triggers the compulsory-fields validator. Cannot activate if required fields are missing. |
activityExpirationDate | String | null | ISO date string. Activities past this date are auto-deactivated on dashboard render. |
forcedInactive | Boolean | false | Set by admin tools to prevent re-activation. |
Template override
| Field | Type | Notes |
|---|---|---|
templateId | ObjectId | Optional reference to a Template document. Takes priority over the OU-level and org-level template fallbacks in the 3-tier lookup. |
Activation validation
When active is set to true, Mongoose calls hasEmptyCompulsoryFields(this) (from src/lib/utils). If any compulsory field is empty the validator rejects the save with:
Cannot activate activity: compulsory fields must be filled
Deactivation (active: false) always succeeds without validation.