GDPR compliance, a living ROPA not a spreadsheet.
EU DPAs issued €1.2B in fines in 2024. The processing chain changes weekly; your spreadsheet ROPA stopped reflecting reality six months ago. Living ROPA with field-level change history, DPIAs that auto-trigger on threshold processing, and DSAR fulfillment that hits the 30-day clock without a fire drill.
- All 99 GDPR articles · 11 chapters · 173 recitals
- Living Article 30 ROPA · field-level change history
- EDPB-aligned Article 35 DPIA threshold engine
- DSAR 30-day clock · 72-hour breach playbook
What is GDPR compliance software?
Article 30 doesn’t say “maintain a snapshot” — it says reflect the most up-to-date information. Living ROPA captures every change at the field level, ties each to its source event (product launch, vendor change, retention review), and triggers DPIAs automatically when EDPB threshold criteria hit two of nine. The Article 33 72-hour breach clock runs in the background. DSAR fulfillment lands inside 30 days, every time. Aligned to the full text of the GDPR — all 99 articles, EDPB WP248 methodology, UK GDPR variants.
Your ROPA is a spreadsheet. The processing chain changes weekly.
The DPO challenge isn't the breach playbook (which is well-documented). It's the slow erosion of accountability data: every product launch adds processing the ROPA doesn't reflect, every vendor change touches Article 28 obligations the spreadsheet can't track. Here's where it actually breaks.
Your ROPA is a spreadsheet. It stopped reflecting reality six months ago.
Article 30 requires the ROPA to reflect the most up-to-date information — and the heterogeneous, dynamic nature of accountability data is the #1 sustainability problem privacy teams cite. Living ROPA with field-level change history, integration with product catalogs and vendor inventories, and auto-flagging when downstream changes invalidate a record.
Asked product about new processing. Got vague answers. Wrote it down anyway.
The 6-month DPO information-gathering pain: business units answer ROPA questionnaires generically, the DPO writes what they got. The audit trail looks complete; the ROPA isn't. Structured intake forms tied to product launches, contract changes, and vendor onboarding — processing records are filled at the source, not retrofitted at quarter-end.
GDPR + UK GDPR + CCPA + LGPD. Same data. One DPO.
EU DPAs issued €1.2B in fines in 2024. Privacy programs have expanded because of AI, cross-jurisdiction enforcement is up, and one DPO is running 4+ regimes. Score one processing activity against GDPR + UK GDPR + CCPA + LGPD + ISO 27701 simultaneously. Same ROPA, multiple lawful-basis evaluations, multiple DSAR rights workflows.
Stop guessing whether processing needs a DPIA.
Article 35 mandates a DPIA when processing is “likely to result in a high risk” to data subjects. The EDPB WP248 guidelines turn that vague standard into a 9-criteria test: 2+ hits = DPIA required. Most teams either over-DPIA every project or under-DPIA the high-risk ones. The threshold engine runs the test on every ROPA record automatically.
- 9-criteria EDPB test — scoring, automated decisions, monitoring, sensitive data, scale, matching, vulnerable subjects, new tech, rights blocking
- Auto-trigger — 2+ criteria hit = DPIA workflow opens, routed to DPO with the ROPA record pre-populated
- Residual-risk worksheet — EDPB-aligned methodology, mitigation matrix, supervisory-authority consultation flag if residual is high
- DPO sign-off path — approval routing with attestation; DPIA decisions linked to the source ROPA record forever
Spreadsheets capture a moment. The ROPA is supposed to be live.
Article 30 doesn't say “maintain a snapshot” — it says reflect the most up-to-date information. The processing chain changes every week. Living ROPA captures every change at the field level, ties each change to its source event (product launch, vendor change, retention review), and notifies downstream owners — DPIAs, DPAs, lawful-basis records — when their inputs move.
When the supervisory authority asks for “the ROPA as of the date of this complaint,” the answer is two clicks — not a forensic excavation across three Excel files and an email thread.
See the living ROPA on real dataThe ROPA used to live in three Excel files. Now it's a living document the supervisory authority can drill into.
GDPR 99-Article Checklist + ROPA + DPIA Pack
Thirty-six pages walking through all 99 GDPR articles with EDPB-aligned implementation guidance, the Article 30 ROPA template (controller and processor versions), and the EDPB-aligned Article 35 DPIA threshold worksheet.
- All 99 articles + 173 recitals
- Article 30 ROPA template (controller + processor)
- EDPB Article 35 DPIA threshold worksheet
- Schrems II Transfer Impact Assessment template
Looking for GDPR ↔ UK GDPR ↔ CCPA ↔ LGPD crosswalk or the platform buyer's guide? Find them on the compliance frameworks hub.
Common questions, answered up front.
About GDPR compliance, ROPA, DPIAs, DSARs, the 72-hour breach clock, and how RiskWatch covers all of them.
What is GDPR compliance software?
What is a ROPA and why does Article 30 matter?
How does the DPIA threshold engine work?
How does the 72-hour breach clock work?
How does DSAR fulfillment work?
Does the platform support GDPR + UK GDPR + CCPA + LGPD simultaneously?
Is there a free trial?
Build your Article 30 ROPA this week.
Start a 30-day free trial — every article, the living ROPA, DPIA threshold engine, DSAR queue, the 72-hour breach playbook. No credit card required.
No credit card required · 30-day free trial · Cancel anytime