# Standards and Regulatory References — RoPA Completeness Audit

## Primary Legislation

### GDPR

- **Art. 30(1)(a)-(g)**: The seven mandatory controller fields forming the baseline for any completeness assessment.
- **Art. 30(2)(a)-(d)**: The four mandatory processor fields.
- **Art. 30(4)**: Obligation to make records available to the supervisory authority on request — the practical trigger for readiness audits.
- **Art. 5(2)**: Accountability principle requiring the controller to demonstrate compliance. Completeness scoring quantifies the degree to which this demonstration is achievable.
- **Art. 58(1)(a)**: Supervisory authority power to order the provision of information, including processing records, supporting the need for readiness.

## Supervisory Authority Templates and Guidance

### CNIL (France)

- **CNIL RoPA Template (updated 2024)**: Published in PDF and CSV format at cnil.fr. Includes mandatory Art. 30 fields plus recommended fields for lawful basis, DPIA reference, and review date. The CNIL template is considered the most structured in the EU.
- **CNIL Guide Pratique — Le Registre des Activites de Traitement**: Step-by-step guidance on completing the CNIL template, with examples for common processing activities (HR, marketing, CCTV, website).
- **CNIL enforcement approach**: CNIL routinely requests RoPA during investigations and audits. The template serves as the benchmark against which CNIL assessors evaluate completeness.

### ICO (United Kingdom)

- **ICO Documentation and Records Guidance (updated 2024)**: Provides a RoPA template aligned with UK GDPR Art. 30. Requires lawful basis documentation beyond the literal Art. 30 text.
- **ICO Accountability Framework Tool**: Self-assessment tool including RoPA completeness questions. Scored expectations include: "Do you document the lawful basis for each processing activity in your records?"
- **ICO Enforcement Notices**: Multiple enforcement notices have included requirements to improve RoPA documentation, establishing the ICO's practical expectations.

### BfDI (Germany)

- **BfDI Hinweise zum Verzeichnis von Verarbeitungstaetigkeiten (2024)**: Guidance document specifying the BfDI's expectations for RoPA content. Requires separate documentation of technical and organisational measures (splitting Art. 30(1)(g) into two sub-fields).
- **DSK (Datenschutzkonferenz) — Working Paper on Art. 30**: Joint guidance from all German state data protection authorities harmonising expectations for RoPA.
- **Sector-specific requirements**: The BfDI publishes additional guidance for federal public authorities that goes beyond private-sector requirements.

### Other SA Templates

- **AEPD (Spain)**: Facilita RGPD tool generates RoPA through guided questionnaire. Serves as the AEPD's practical template.
- **Garante (Italy)**: Publishes guidance on RoPA with emphasis on processor records and international transfers.
- **CNDP (Morocco)**: While not an EEA SA, provides a structured RoPA template under Law 09-08 that aligns closely with GDPR Art. 30.

## Enforcement Precedents Relevant to Completeness

- **Romanian DPA (ANSPDCP) — EUR 15,000 against Unicredit Bank (2019)**: Incomplete RoPA with missing purposes and retention. Demonstrates SA inspection of field completeness.
- **Belgian DPA — Decision 21/2022**: RoPA not maintained up to date. SA assessed both presence and currency of information.
- **Polish DPA (UODO) — Decision ZSZZS.440.768.2018**: Records did not reflect actual processing. SA compared RoPA against observed data flows.
- **CNIL — Multiple Article 30 findings in annual inspections**: CNIL's annual activity report consistently identifies Art. 30 deficiencies as among the most common findings during on-site inspections.

## Audit Standards

- **ISACA COBIT 2019**: Control objective APO01.08 (Data Classification) and MEA03.03 (Monitor and evaluate compliance with external requirements) support the structured audit approach to RoPA completeness.
- **ISO 19011:2018 — Guidelines for auditing management systems**: Provides the general audit methodology (planning, conducting, reporting, follow-up) applicable to RoPA completeness audits.
- **IIA International Standards for the Professional Practice of Internal Auditing (2024)**: Standard 2201 (Planning Considerations) and Standard 2320 (Analysis and Evaluation) apply to internal audit of RoPA.