Blog

Investor onboarding, AML/KYC, FATCA/CRS reporting, PSC registers, and third-country transfer chains all generate Article 30 obligations. Here is what a usable register looks like across complex fund structures.

Law firms must balance legal professional privilege and SRA retention duties with GDPR transparency, and a fragile spreadsheet will not survive that tension.

A Data Protection Impact Assessment is the GDPR's risk assessment for high-risk processing, required under Article 35 before processing begins. This is the framework page for the DPIA: when it is mandatory, what it contains, and how it sits alongside your RoPA.

A Data Subject Access Request is an individual's right to access the personal data you hold about them, under Article 15 of the GDPR, with a one-month deadline. This is the framework page for the DSAR: how it works, what a response must contain, and how it depends on your RoPA.

The Data Protection (Jersey) Law 2018 is Jersey's GDPR-equivalent regime, supervised by the Jersey Office of the Information Commissioner, with EU adequacy. This is the framework page for the DPJL: what it covers, how it mirrors the GDPR, and where it diverges.

The one-month deadline is rarely what sinks a DSAR response. What sinks it is everything you have to leave out: other people's data, privileged advice, and the systems your data map never covered.

Article 35 makes a DPIA mandatory before high-risk processing begins, and the threshold is lower than most teams assume. Here is when the obligation bites, what the assessment actually contains, and how to run one that survives ICO scrutiny.

Data mapping is the foundation of GDPR compliance, but most teams make the same avoidable mistakes. Here are the most common data mapping errors and how to fix them.

Jersey has run its own GDPR-equivalent regime since 25 May 2018 and has held EU adequacy since 2008. This guide covers the DPJL 2018, the JOIC, registration, DPIAs, breach notification, and where Jersey law genuinely diverges from the GDPR.

The EU AI Act's high-risk obligations are live. If your AI system processes personal data, your DPIA needs to account for model opacity, bias, and function creep. Here is what that looks like in practice.

Spreadsheet-based Records of Processing are hard to maintain and harder to understand. Visual data flow maps make compliance clearer and audits smoother.

Before you sign a data processing agreement, ask your processor these 10 questions. This Article 28 GDPR checklist covers sub-processors, transfers, security, and audit rights, with a template you can reuse.

Article 30 of the UK and EU GDPR is the provision that forces every controller and most processors to keep a written record of their processing activities. This is the framework page for the obligation: who it binds, what it demands, and how it feeds the rest of your compliance programme.

A Record of Processing Activities is the register of everything you do with personal data, built on Article 30. This is the framework page for the RoPA: what it is, what goes in it, who needs one, and how it feeds a DPIA, a DSAR and breach response.

AI extraction is changing how SMEs build GDPR Records of Processing Activities. From free-text input to structured Article 30 fields with confidence scores, here is where AI actually helps small compliance teams.

RoPA, DPIA, and DSAR are frequently confused but serve distinct functions in a compliance programme. This guide separates them with concrete triggers, deadlines, and data types, and shows how they reinforce each other.

A Record of Processing Activities is the register GDPR builds everything else on: what personal data you hold, why you hold it, where it goes and when it leaves. Here is what goes in one, who actually needs one, and why it decays faster than you expect.

Download our free Article 30 Records of Processing Activities template — and learn why most organisations outgrow spreadsheets within six months.

Article 30 GDPR requires controllers and processors to keep records of processing activities. This guide works through the article paragraph by paragraph: the required fields, the written-form rule, the exemption almost nobody qualifies for, and what enforcement actually looks like.