# Standards and Regulatory References — RoPA Executive Dashboard

## Primary Legislation

### GDPR Articles Supporting RoPA Reporting

- **Art. 5(2) — Accountability**: The controller must demonstrate compliance. Executive dashboards provide quantifiable evidence of the controller's compliance posture derived from RoPA data.
- **Art. 24(1) — Responsibility of the Controller**: Requires the controller to implement measures to ensure and demonstrate compliance. Board-level reporting on RoPA metrics demonstrates governance oversight.
- **Art. 38(3) — Tasks of the DPO**: The DPO shall report to the highest management level of the controller. The annual DPO report to the board should include RoPA compliance metrics.
- **Art. 39(1)(b) — Tasks of the DPO**: The DPO monitors compliance with the regulation. RoPA dashboards are a primary monitoring tool.

## Regulatory Guidance

### EDPB

- **EDPB Guidelines on the role of the DPO (WP243 rev.01)**: Clarifies that the DPO must be able to report directly to the highest management level. Structured reporting on processing activities and compliance metrics supports this mandate.

### National Supervisory Authorities

- **CNIL (France)**: The CNIL's accountability framework assessment includes questions about governance reporting on data protection, including whether processing activity records are regularly reviewed and reported to management.
- **ICO (United Kingdom)**: The ICO's accountability framework tool includes a governance section that assesses whether the organisation has "appropriate management structures, including reporting to the board." RoPA dashboards directly support this.
- **BfDI (Germany)**: The BfDI's guidance on the DPO role emphasises regular reporting to management on the state of data protection compliance, with RoPA as a foundational data source.

## Corporate Governance Standards

- **UK Corporate Governance Code (2024)**: Principle O states that the board should establish formal and transparent procedures for developing and implementing risk management and internal control systems. RoPA dashboards feed into risk management reporting.
- **German Corporate Governance Code (DCGK 2022)**: Principle 5 requires the supervisory board to monitor the management board's compliance with applicable law. Data protection compliance metrics support this oversight.
- **EU Directive 2022/2464 (CSRD)**: While focused on sustainability reporting, the Corporate Sustainability Reporting Directive establishes precedent for structured compliance reporting, and privacy metrics may become part of social governance reporting.

## ISO/IEC Standards

- **ISO/IEC 27701:2019**: Section 5.4.1 (Management review) requires top management to review the PIMS at planned intervals, including review of processing records. Dashboard metrics support structured management review.
- **ISO 31000:2018 — Risk Management**: Section 6.7 (Recording and reporting) requires risk reporting to be tailored to the audience. Executive dashboards translate technical RoPA data into governance-relevant metrics.