GDPR Article 30 Compliance¶

GDPR Article 30 requires organizations processing personal data to maintain records of processing activities (ROPA).

Required Record Elements¶

Each processing activity record must include:

1. Controller/Processor identity -- Name and contact details
2. Processing purposes -- Why data is processed
3. Data subject categories -- Types of individuals affected
4. Personal data categories -- Types of data processed
5. Data recipients -- Who receives the data
6. International transfers -- Third country transfers and safeguards
7. Retention periods -- How long data is kept
8. Security measures -- Technical and organizational safeguards

How Dxtra Supports Article 30¶

Processing Purposes¶

Configure processing purposes in the dashboard under Purposes. Each purpose documents:

Processing Activity Log¶

The Activity Log in the dashboard records:

Data Controller Information¶

Configure your controller details in the dashboard:

• Organization name and title
• DID (deterministic identifier)
• Contact information
• DPO details

Data Processor Tracking¶

Manage processors in the dashboard under Processors:

• Processor name and service category
• Retention and usage periods
• Processing purpose configuration
• Integration status

Article 30 Checklist¶

Processing Activity Documentation¶

• Each processing purpose has a clear name and description
• Legal basis documented for each purpose (Article 6 justification)
• Data categories specified via field mappings
• Data subject categories identified

Recipients and Transfers¶

• Internal recipients documented (user roles with access)
• External processors configured with retention details
• Third country transfers identified
• Transfer safeguards documented (SCCs, adequacy decisions)

Retention and Security¶

• Retention periods configured for each purpose
• Usage periods set for active processing
• Security measures documented at organizational level
• DPIA completed for high-risk processing

Legal Basis by Region¶

Dxtra maintains legal basis citation references for 40+ jurisdictions:

EU/EEA Jurisdictions¶

Other Jurisdictions¶

Retention Period Configuration¶

Configure retention periods in the dashboard. Common retention periods:

Pre-configured Processor Retention¶

Dxtra includes retention defaults for common processors:

Generating Article 30 Documentation¶

Document Structure¶

Organize Article 30 documentation:

1. Controller information -- Name, contact, DPO
2. Processing purposes -- Each purpose with legal basis
3. Data categories -- Fields processed per purpose
4. Recipients -- Processors and sub-processors
5. Retention schedule -- Periods per purpose/processor
6. Security measures -- Organizational controls

Export from Dxtra¶

Use the Purposes and Processors sections in the dashboard to review and export your processing records. The Activity Log provides the processing history for audit purposes.

Implementation Steps¶

1. Configure Data Controller -- Set up organization profile with contact details
2. Define processing purposes -- Create purposes with legal basis and retention
3. Map data categories -- Assign data field types to each purpose
4. Configure processors -- Add data processors with retention details
5. Document security -- Record organizational security measures
6. Review and update -- Maintain records as processing changes

For Auditors and Regulators¶

Records Available for Audit¶

Related Documentation¶

• GDPR Implementation -- Full GDPR compliance guide
• Data Retention -- Retention policy management
• Compliance Overview -- All compliance features
• Data Controller Setup -- Initial configuration