Updated September 25, 2026: every legal and factual statement in this article was re-checked against the primary source and corrected where needed.
In the early days of the GDPR, a spreadsheet was the obvious place to start a record of processing activities (ROPA). Privacy teams would email department heads, ask what data they were collecting, type it into Excel, and hope for the best.
Today, that approach is not just inefficient — it is a liability.
In short: a spreadsheet-based record of processing is a snapshot that starts going stale the moment it's saved — it doesn't catch shadow IT, schema changes, or new vendors — so handing a regulator a six-month-old spreadsheet signals you don't actually control your data. The fix is a living data inventory: a standardized intake gate, a defined review cadence, and named ownership for every data flow, replacing an annual clean-up with a process that stays current.
The problem with 'snapshot' compliance
A spreadsheet is a static snapshot in time. The moment you hit 'Save,' it starts going stale.
- Shadow IT: a team signs up for a new SaaS tool without telling anyone.
- Data drift: engineering changes a database schema and starts collecting new sensitive fields.
- Vendor sprawl: data begins flowing to new third-party processors.
Your manual record of processing captures none of this. When a regulator knocks, handing over a six-month-old spreadsheet signals that you do not actually control your data.
The shift to a living data inventory
Modern privacy operations need a record that stays current — not a once-a-year clean-up. The fix is process, not heroics: a standardized intake gate so new systems and vendors are captured before they go live, a defined review cadence so the inventory is refreshed on a schedule, and clear ownership so every data flow has a named accountable owner.
- Context, not just a list: each entry records why you hold the data — its legal authority and retention.
- Traceable lineage: you can see where data flows, from intake to storage to third-party processor.
- Early warning: the intake gate surfaces a new high-risk data type while it can still be designed out, not after it ships.
Stop chasing updates
Your privacy team is too valuable to spend its days chasing operational updates. Mosaic builds the standardized process — and the senior-reviewed inventory — that replaces 'compliance by spreadsheet' with a program you can defend at any moment.