EU Regulation 2016/679 · Supervisory authorities · Ongoing
FRAMEWORKGDPR isn't a project you finish it's a posture you hold. Uproot builds your Record of Processing from real data flows and proves Article 32 security continuously.
RoPA generated in minutes
Breach notification ready at 72 hours
acme-eu · GDPR programme
controller + processor · EU/EEA
86%
in good standing
Obligation areas
47 controls
Records of processing
RoPA · live
96%
Lawful basis & consent
Art. 6–7
88%
Data subject rights
Art. 12–23 · DSARs
82%
Security of processing
Art. 32
93%
Processors & transfers · SCCs
Art. 28 · 44–49
74%
RoPA entries
42 live
DPAs signed
31 / 34
Breach clock
72h ready
RoPA updated automatically
A new analytics processor was detected. Art.30 records and the transfer basis updated in place.
Articles
99The regulation runs to 99 articles and 173 recitals. A handful create the obligations you operate day to day.
Breach notification
72hoursNotifiable personal-data breaches must reach the supervisory authority within 72 hours of awareness.
Maximum fine
4%or €20MUp to 4% of global annual turnover, or €20 million — whichever is higher.
Authority
EDPBEnforced by national supervisory authorities, coordinated by the European Data Protection Board.
Status
OngoingNot a certificate. A continuous obligation — exactly what continuous evidence is built for.
GDPR is broad, but for a product team it concentrates into a few operational duties: know what you process, have a lawful reason, honour people's rights, secure the data, and govern who else touches it. Uproot operates all five from your real systems.
Records of processing
An inventory of what personal data you process, why, and for how long — the document every regulator asks for first.
Lawful basis & consent
Every processing activity needs a lawful basis — recorded and defensible.
Data subject rights
Access, erasure, portability, and objection — answered within statutory deadlines, usually one month.
Security of processing
Encryption, resilience, and testing — where your security posture becomes a privacy obligation.
Processors & transfers
DPAs with every sub-processor, and a valid transfer mechanism for data leaving the EEA.
The RoPA is the document teams maintain by hand and dread updating. Uproot builds it from your actual data flows and keeps it true.
Controllers and processors must maintain a record of processing activities: purposes, categories of data and data subjects, recipients, transfers, retention periods, and security measures. Get this wrong and every other conversation with a regulator starts on the back foot.
"Uproot PtaaS offers the perfect suite of features to ensure the highest security standards for our clients. We are impressed by their dedication to continuous testing. Their seamless integration combined with the hacker mindset and thorough manual pentesting approach, truly sets them apart."
ART. 30 · RECORDS OF PROCESSING
Record of processing activities
Last regenerated 09:14:02 UTC · 42 activities · sha256 verified
The article
What Article 30 asks for
Your real data flows
What we read from your systems
Uproot maps where personal data actually lives and moves — not a survey of what teams think they collect.
Record assembled
Purposes, recipients, retention, transfers
Each activity is built with its lawful basis, recipients, retention period, and transfer mechanism — versioned and timestamped.
For the regulator / DPO
Export-ready, always current
Your DPO — or a supervisory authority — gets a complete, current RoPA on demand, with the lineage showing where every entry came from.
Role · Controller + Processor · Activities· 42 · Gaps · 0
GDPR is ongoing, so the goal isn't a certificate — it's a programme you can defend to a regulator on any given day.
Day 0
Map personal data
Uproot discovers where personal data lives across your databases, SaaS, and processors — the foundation of everything else.
Day 1–2
Generate the RoPA
Article 30 records built from real flows, each with purpose, lawful basis, recipients, and retention.
Day 3–18
Close the gaps
Missing DPAs collected, transfer mechanisms attached, Article 32 measures verified, DSAR workflow stood up.
Day 19–30
Defensible
Programme documented, breach plan rehearsed, 72-hour clock ready. Able to answer a regulator or a customer DPA review.
Ongoing
Stay current
New processors, schema changes, and transfers update the RoPA automatically. Drift becomes a ticket, not a surprise.
A RoPA rebuilt from interviews once a year — wrong the moment a team ships a new integration
DPAs scattered across inboxes and a deal desk, with no view of which sub-processors lack one
A breach plan in a slide deck that no one has run against the 72-hour clock
Article 32 security described in a policy, never tied to what’s actually deployed
A RoPA generated from real data flows and regenerated when they change
Every processor DPA and transfer mechanism tracked, gaps surfaced as tickets
A breach workflow wired to your incident response, evidence and clock ready at hour zero
Article 32 measures proven from the live environment, not asserted on paper
A partial map of the obligations Uproot evidences from source systems — data inventory, security measures, processors, and rights handling.
Data inventory
Postgres · PII columns
tagged
Segment · data flows
mapped
Snowflake · warehouse
classified
Retention schedule
live
Security measures
KMS · encryption at rest
all
TLS · in transit
1.2+
AWS · backup + DR
tested
Pen test · annual
on file
Processors
Sub-processor list
34
DPAs signed
31 / 34
SCCs · non-EEA
attached
Transfer impact assess
live
Rights & breach
DSAR workflow
≤30d
Consent records
versioned
Incident response · IRP
72h
Breach register
live
GDPR has no certifying body; your lead supervisory authority is determined by your main establishment. Whichever it is, Uproot keeps the RoPA, security evidence, and breach record export-ready.
CNIL
france
DPC
ireland
BfDI
germany
AEPD
spain
Garante
italy
AP
netherlands
ICO
uk gdpr
CNPD
luxembourg
Datatilsynet
denmark
IMY
sweden
EDPB
coordination
+ all 27
EU/EEA
Not in the way people mean. GDPR allows approved certification mechanisms (Article 42), but there's no universal certificate. Compliance is an ongoing posture you demonstrate — which is exactly what continuous evidence provides.
Only if your core activities involve large-scale monitoring or special-category data, or you're a public authority. Many companies appoint one anyway. Uproot gives whoever holds the role a live RoPA and evidence base to work from.
The Record of Processing Activities (Article 30) is the inventory of what you process and why. It's almost always a regulator's first request. Uproot generates it from your real systems so it's accurate, not aspirational.
Transfers to non-adequate countries need a mechanism — usually Standard Contractual Clauses plus a transfer impact assessment. Uproot tracks which processors are outside the EEA and whether a valid mechanism is attached.
Notifiable breaches go to the supervisory authority within 72 hours of becoming aware, and to affected individuals without undue delay if the risk is high. Uproot keeps incident evidence and the clock ready before an incident happens.
They share a spine — data inventory, rights handling, vendor governance — but differ in mechanics. If you run GDPR with Uproot, most of CCPA falls out of the same data map and processor tracking.
Map your personal data, generate the RoPA by lunch, and keep processors, transfers, and Article 32 security provable. When a regulator asks, the record is already current.
