OpenDQV Cloud starter template (v0.1) — your tenant inherits this baseline. First customer edit creates v1.0 in your audit trail; pin by yaml_hash for replay. EU GDPR Article 30 — Regulation (EU) 2016/679, Record of Processing Activity (ROPA) compliance contract. Every controller established in the EU must maintain records of processing activities under Article 30(1). This contract enforces completeness at the point of write: lawful basis, purpose, data categories, retention period, and conditional fields for consent processing, legitimate interests assessments, special category data, and international transfers. The supervisory authority field records the lead DPA under the one-stop-shop mechanism (Article 56). The omission failure mode: a processing activity recorded without lawful basis, purpose, or retention period. Supervisory authority audit fails. Administrative fines up to EUR 10M or 2% of global annual turnover under Article 83(4) for Article 30 violations.
| Rule | Field | Severity | What it enforces (the message your team sees) |
|---|---|---|---|
| record_id_required | record_id | error | record_id is required — every ROPA entry must be uniquely identifiable per Article 30(1) EU GDPR |
| controller_name_required | controller_name | error | controller_name is required — Article 30(1)(a) EU GDPR requires the name and contact details of the controller |
| supervisory_authority_required | supervisory_authority | error | supervisory_authority is required — Article 56 EU GDPR one-stop-shop mechanism requires identification of the lead supervisory authority |
| supervisory_authority_valid | supervisory_authority | error | supervisory_authority must be one of the 27 EU member state DPAs — per Article 56 EU GDPR one-stop-shop mechanism |
| processing_purpose_required | processing_purpose | error | processing_purpose is required — Article 30(1)(b) EU GDPR requires the purposes of the processing to be recorded |
| lawful_basis_required | lawful_basis | error | lawful_basis is required — Article 6(1) EU GDPR requires at least one lawful basis for every processing activity |
| lawful_basis_valid | lawful_basis | error | lawful_basis must be one of: consent, contract, legal_obligation, vital_interests, public_task, legitimate_interests — these are the six Article 6(1) bases |
| data_categories_required | data_categories | error | data_categories is required — Article 30(1)(c) EU GDPR requires a description of the categories of personal data |
| data_subjects_required | data_subjects | error | data_subjects is required — Article 30(1)(c) EU GDPR requires a description of the categories of data subjects |
| recipients_required | recipients | error | recipients is required — Article 30(1)(d) EU GDPR requires the categories of recipients; use 'none' if data is not shared |
| retention_period_required | retention_period | error | retention_period is required — Article 30(1)(f) EU GDPR requires the envisaged time limits for erasure of the different categories of data |
| consent_mechanism_required_if_consent | consent_mechanism | error | consent_mechanism is required when lawful_basis is consent — Article 7(1) EU GDPR requires the controller to demonstrate how consent was obtained |
| consent_timestamp_required_if_consent | consent_timestamp | error | consent_timestamp is required when lawful_basis is consent — record when the data subject gave consent (ISO 8601) |
| consent_timestamp_format | consent_timestamp | error | consent_timestamp must be a valid date (YYYY-MM-DD) |
| withdrawal_mechanism_required_if_consent | withdrawal_mechanism | error | withdrawal_mechanism is required when lawful_basis is consent — Article 7(3) EU GDPR requires that withdrawal of consent is as easy as giving it; record how the data subject can withdraw |
| lia_completed_required_if_legitimate_interests | lia_completed | error | lia_completed is required when lawful_basis is legitimate_interests — a Legitimate Interests Assessment must be documented per Article 6(1)(f) EU GDPR |
| lia_completed_valid | lia_completed | error | lia_completed must be 'true' or 'false' |
| lia_date_required_if_lia_completed | lia_date | error | lia_date is required when lia_completed is true — record the date the Legitimate Interests Assessment was completed |
| lia_date_format | lia_date | error | lia_date must be a valid date (YYYY-MM-DD) |
| special_category_data_required | special_category_data | error | special_category_data must be declared (true or false) — Article 9 EU GDPR requires explicit identification of special category data processing |
| special_category_data_valid | special_category_data | error | special_category_data must be 'true' or 'false' |
| special_category_basis_required_if_special | special_category_basis | error | special_category_basis is required when special_category_data is true — Article 9(2) EU GDPR requires an explicit legal basis for processing special category data |
| special_category_basis_valid | special_category_basis | error | special_category_basis must be one of the Article 9(2) bases: explicit_consent, employment_law, vital_interests, not_for_profit, made_public, legal_claims, substantial_public_interest, medical_diagnosis, public_health, archiving_research |
| special_category_types_required_if_special | special_category_types | error | special_category_types is required when special_category_data is true — record which special categories are processed (e.g. health, biometric, racial origin, political opinions) |
| international_transfer_required | international_transfer | error | international_transfer must be declared (true or false) — Article 30(1)(e) EU GDPR requires recording of transfers to third countries |
| international_transfer_valid | international_transfer | error | international_transfer must be 'true' or 'false' |
| transfer_safeguard_required_if_transfer | transfer_safeguard | error | transfer_safeguard is required when international_transfer is true — Articles 44–49 EU GDPR require an appropriate safeguard for international transfers |
| transfer_safeguard_valid | transfer_safeguard | error | transfer_safeguard must be one of: adequacy_decision, standard_contractual_clauses, binding_corporate_rules, binding_corporate_rules_processor, approved_code_of_conduct, approved_certification_mechanism, derogation — per Articles 44–49 EU GDPR |
| dpo_reviewed_by_required | dpo_reviewed_by | error | dpo_reviewed_by is required — record who reviewed this ROPA entry for Article 30 EU GDPR compliance |
| dpo_review_date_required | dpo_review_date | error | dpo_review_date is required |
| dpo_review_date_format | dpo_review_date | error | dpo_review_date must be a valid date (YYYY-MM-DD) |
Run your own data against this contract in the free trial — drop a CSV in the dashboard, no code, no credit card. Start free trial →