OpenDQV Cloud starter template (v0.1) — your tenant inherits this baseline. First customer edit creates v1.0 in your audit trail; pin by yaml_hash for replay. UK GDPR Article 30 — Record of Processing Activity (ROPA) compliance contract. Every controller must maintain records of processing activities under Article 30(1). This contract enforces completeness at the point of write: lawful basis, purpose, data categories, retention period, and conditional fields for consent processing, legitimate interests assessments, special category data, and international transfers. The omission failure mode: a processing activity recorded without lawful basis, purpose, or retention period. ICO audit fails. Enforcement notice issued.
| Rule | Field | Severity | What it enforces (the message your team sees) |
|---|---|---|---|
| record_id_required | record_id | error | record_id is required — every ROPA entry must be uniquely identifiable per Article 30(1) UK GDPR |
| controller_name_required | controller_name | error | controller_name is required — Article 30(1)(a) UK GDPR requires the name and contact details of the controller |
| processing_purpose_required | processing_purpose | error | processing_purpose is required — Article 30(1)(b) UK GDPR requires the purposes of the processing to be recorded |
| lawful_basis_required | lawful_basis | error | lawful_basis is required — Article 6(1) UK GDPR requires at least one lawful basis for every processing activity |
| lawful_basis_valid | lawful_basis | error | lawful_basis must be one of: consent, contract, legal_obligation, vital_interests, public_task, legitimate_interests — these are the six Article 6(1) bases |
| data_categories_required | data_categories | error | data_categories is required — Article 30(1)(c) UK GDPR requires a description of the categories of personal data |
| data_subjects_required | data_subjects | error | data_subjects is required — Article 30(1)(c) UK GDPR requires a description of the categories of data subjects |
| recipients_required | recipients | error | recipients is required — Article 30(1)(d) UK GDPR requires the categories of recipients; use 'none' if data is not shared |
| retention_period_required | retention_period | error | retention_period is required — Article 30(1)(f) UK GDPR requires the envisaged time limits for erasure of the different categories of data |
| consent_mechanism_required_if_consent | consent_mechanism | error | consent_mechanism is required when lawful_basis is consent — Article 7(1) UK GDPR requires the controller to demonstrate how consent was obtained |
| consent_timestamp_required_if_consent | consent_timestamp | error | consent_timestamp is required when lawful_basis is consent — record when the data subject gave consent (ISO 8601) |
| consent_timestamp_format | consent_timestamp | error | consent_timestamp must be a valid date (YYYY-MM-DD) |
| withdrawal_mechanism_required_if_consent | withdrawal_mechanism | error | withdrawal_mechanism is required when lawful_basis is consent — Article 7(3) UK GDPR requires that withdrawal of consent is as easy as giving it; record how the data subject can withdraw |
| lia_completed_required_if_legitimate_interests | lia_completed | error | lia_completed is required when lawful_basis is legitimate_interests — a Legitimate Interests Assessment must be documented per Article 6(1)(f) UK GDPR |
| lia_completed_valid | lia_completed | error | lia_completed must be 'true' or 'false' |
| lia_date_required_if_lia_completed | lia_date | error | lia_date is required when lia_completed is true — record the date the Legitimate Interests Assessment was completed |
| lia_date_format | lia_date | error | lia_date must be a valid date (YYYY-MM-DD) |
| special_category_data_required | special_category_data | error | special_category_data must be declared (true or false) — Article 9 UK GDPR requires explicit identification of special category data processing |
| special_category_data_valid | special_category_data | error | special_category_data must be 'true' or 'false' |
| special_category_basis_required_if_special | special_category_basis | error | special_category_basis is required when special_category_data is true — Article 9(2) UK GDPR requires an explicit legal basis for processing special category data |
| special_category_basis_valid | special_category_basis | error | special_category_basis must be one of the Article 9(2) bases: explicit_consent, employment_law, vital_interests, not_for_profit, made_public, legal_claims, substantial_public_interest, medical_diagnosis, public_health, archiving_research |
| special_category_types_required_if_special | special_category_types | error | special_category_types is required when special_category_data is true — record which special categories are processed (e.g. health, biometric, racial origin, political opinions) |
| international_transfer_required | international_transfer | error | international_transfer must be declared (true or false) — Article 30(1)(e) UK GDPR requires recording of international transfers |
| international_transfer_valid | international_transfer | error | international_transfer must be 'true' or 'false' |
| transfer_safeguard_required_if_transfer | transfer_safeguard | error | transfer_safeguard is required when international_transfer is true — Articles 44–49 UK GDPR require an appropriate safeguard for international transfers |
| transfer_safeguard_valid | transfer_safeguard | error | transfer_safeguard must be one of: adequacy_decision, standard_contractual_clauses, binding_corporate_rules, derogation, approved_code_of_conduct, approved_certification |
| dpo_reviewed_by_required | dpo_reviewed_by | error | dpo_reviewed_by is required — record who reviewed this ROPA entry for Article 30 compliance |
| dpo_review_date_required | dpo_review_date | error | dpo_review_date is required |
| dpo_review_date_format | dpo_review_date | error | dpo_review_date must be a valid date (YYYY-MM-DD) |
Run your own data against this contract in the free trial — drop a CSV in the dashboard, no code, no credit card. Start free trial →