# RoPA Executive Dashboard — Helix Biotech Solutions GmbH

**Report Period**: Q4 2024 (October - December 2024)
**Prepared By**: Dr. Elena Voss, Data Protection Officer
**Report Date**: 2025-01-15
**Classification**: Confidential — Internal Use Only

---

## Supervisory Authority Readiness

| Metric | Status | Value | Target | Trend |
|--------|--------|-------|--------|-------|
| Completeness Score | GREEN | 96.2% | >=95% | Up (+3.1pp from Q3) |
| Staleness Rate | AMBER | 7.8% | <=5% | Down (-2.4pp from Q3) |
| DPA Coverage | GREEN | 100% | 100% | Stable |
| Transfer Mechanism Coverage | GREEN | 100% | 100% | Stable |
| DPIA Linkage | GREEN | 100% | 100% | Up (was 94% in Q3) |

**Overall Readiness**: LARGELY READY (staleness rate above 5% target due to 3 records pending Q4 annual review)

---

## Processing Landscape

| Metric | Current Quarter | Previous Quarter | Year-over-Year |
|--------|----------------|-----------------|----------------|
| Total processing activities | 47 | 45 | 38 |
| New activities added | 3 | 2 | 15 |
| Activities archived | 1 | 0 | 6 |
| Departments covered | 7 | 7 | 6 |

---

## Risk Heatmap

| Department | Low | Medium | High | Critical | Total |
|-----------|-----|--------|------|----------|-------|
| Human Resources | 3 | 2 | 1 | 0 | 6 |
| Clinical Operations | 0 | 2 | 5 | 1 | 8 |
| Digital Marketing | 2 | 2 | 1 | 0 | 5 |
| Finance | 4 | 2 | 1 | 0 | 7 |
| IT | 3 | 2 | 1 | 0 | 6 |
| Facilities | 1 | 0 | 1 | 0 | 2 |
| Sales | 2 | 1 | 1 | 0 | 4 |

---

## Key Risk Indicators

| Indicator | Value | Commentary |
|-----------|-------|-----------|
| Special category processing activities | 9 | Stable. 8 involve health data (clinical operations + HR sick leave), 1 involves religious data (church tax). |
| High-risk processing ratio | 23.4% (11 of 47) | Consistent with biotech industry profile. Dominated by clinical trial and pharmacovigilance activities. |
| International transfers (total) | 14 | Increased by 2 in Q4 due to new US-based CRO engagement for Phase III oncology trial. |
| Transfers to non-adequate countries | 6 | All to United States. 4 covered by EU-US Data Privacy Framework, 2 by SCCs Module 3 + TIA. |
| Unique external processors | 23 | Increased by 1 (new CRO: Parexel International). DPA executed 2024-11-15. |

---

## Remediation Status

| Severity | Open | In Progress | Closed | Overdue |
|----------|------|-------------|--------|---------|
| Critical | 0 | 0 | 3 | 0 |
| Major | 2 | 3 | 8 | 1 |
| Minor | 4 | 2 | 12 | 0 |

**Closure Rate**: 92% (target: >=90%) — 1 overdue major item relates to Digital Marketing GA4 retention documentation (GAP-002, original deadline 2024-11-30, extended to 2025-01-31 pending GA4 configuration change)

---

## Top 3 Priorities

1. **Diagnostics S.A.S. integration**: Complete RoPA integration for newly acquired French entity (3 processing activities identified, CNIL template alignment in progress, target: 2025-03-31)
2. **Staleness remediation**: Complete Q4 annual reviews for 3 overdue records (RPA-2024-IT-004, RPA-2024-FAC-001, RPA-2024-SAL-003) to bring staleness rate below 5% target
3. **OneTrust migration**: Board-approved platform migration from Excel to OneTrust (budget: EUR 142k, target go-live: 2025-06-15). Phase 1 contract signed 2025-01-10.

---

## Recommendations

1. Approve dedicated 0.5 FTE privacy analyst allocation for Diagnostics S.A.S. RoPA integration and ongoing CNIL compliance support (French-language requirement)
2. Mandate ServiceNow-to-RoPA webhook integration in Q1 2025 to automatically trigger RoPA reviews when IT change requests affect personal data processing systems
3. Schedule board-level privacy training session in Q2 2025 to cover updated international transfer landscape post-DPF adequacy review

---

**Prepared by**: Dr. Elena Voss, DPO
**Distribution**: Data Protection Steering Committee, CFO, Board Audit Committee