# RoPA-DPIA Cross-Reference Register — Helix Biotech Solutions GmbH

**Last Updated**: 2025-02-28
**Maintained By**: Dr. Elena Voss, DPO

---

## Cross-Reference Matrix

| RoPA ID | Processing Activity | DPIA Required | DPIA Ref | DPIA Status | DPIA Approval | DPIA Next Review | Lawful Basis Ref | Art. 9 Condition |
|---------|---------------------|---------------|----------|-------------|---------------|-----------------|------------------|-----------------|
| RPA-001 | Employee payroll | No | — | — | — | — | LOA-2024-PAY-001 | Art. 9(2)(b) (religion via church tax) |
| RPA-002 | Clinical trial data | Yes | DPIA-2024-ONC-04 | Approved | 2024-02-28 | 2025-02-28 | CON-2024-CT-04 | Art. 9(2)(a) explicit consent |
| RPA-003 | Website analytics | No | — | — | — | — | LIA-2025-GA4-001 | N/A |
| RPA-004 | Performance profiling | Yes | DPIA-2025-PERF-001 | Under review | — | — | LIA-2025-PERF-001 | N/A |
| RPA-005 | CCTV surveillance | Yes | DPIA-2024-CCTV-001 | Approved | 2024-06-15 | 2025-06-15 | LIA-2024-CCTV-001 | N/A |

---

## DPIA Necessity Assessment Log

| RoPA ID | Assessment Date | Criteria Met | Count | DPIA Required | Assessed By | Notes |
|---------|----------------|-------------|-------|---------------|-------------|-------|
| RPA-001 | 2024-01-15 | C4 (religion), C7 (employees) | 2 | No — church tax is minimal special category, standard employment | Dr. Elena Voss | Reassess if HR processing expands |
| RPA-002 | 2024-01-20 | C4 (health/genetic), C5 (large scale), C7 (patients) | 3 | Yes | Dr. Elena Voss | Phase III trial with 500+ participants |
| RPA-003 | 2024-02-01 | None | 0 | No | Dr. Elena Voss | IP truncated, no profiling |
| RPA-004 | 2025-01-10 | C1 (scoring), C7 (employees) | 2 | Yes | Dr. Elena Voss | Performance scoring affects promotions |
| RPA-005 | 2024-05-01 | C3 (monitoring), C5 (systematic) | 2 | Yes | Dr. Elena Voss | Office entrance monitoring |

---

## Cascade Event Log

| Date | Source | Event | Affected Records | Action Taken | Completed By |
|------|--------|-------|-----------------|-------------|-------------|
| 2025-01-15 | RoPA | RPA-002 retention period extended from 10 to 15 years per updated Arzneimittelgesetz requirement | DPIA-2024-ONC-04 | DPIA Section 7 (retention proportionality) reviewed and re-approved. No change to risk assessment. | Dr. Elena Voss |
| 2025-01-28 | DPIA | DPIA-2025-PERF-001 identified additional mitigation: anonymise scores after 12 months | RPA-004 | RoPA retention period field updated to reflect 12-month anonymisation schedule | Sophie Krause |
| 2024-11-20 | RoPA | RPA-005 CCTV coverage extended to parking garage (new camera installation) | DPIA-2024-CCTV-001 | DPIA scope section updated. Risk level unchanged — same technical and organisational measures apply. Re-approved by DPO. | Dr. Elena Voss |
| 2024-09-05 | DPIA | DPIA-2024-ONC-04 annual review completed, no changes to risk profile | RPA-002 | RoPA record marked as reviewed, next review date updated to 2025-09-05 | Sophie Krause |
| 2024-06-15 | DPIA | DPIA-2024-CCTV-001 initially approved with condition: signage must be installed within 30 days | RPA-005 | RoPA security measures field updated to include signage reference (CCTV-SIGN-2024-001) | Thomas Wehner |

---

*This register must be updated whenever a RoPA entry or DPIA is created, modified, or archived. Quarterly integrity checks verify all cross-references are valid.*