DPO Report™ — GDPR Art 30 RoPA & DSAR coverage.
A representative kye.report.v1 envelope for a Data Protection Officer. The bytes you see are signature-covered — anyone with the published assembler_kid public key can verify the report locally, with no portal log-in and no vendor cooperation.
Synthetic tenant. Real reports carry tenant-PII and are scoped to the customer's admin console. Mechanism details are part of the patent track and not disclosed in this repository.
Executive verdict
Acme Ltd is GDPR Art 30 RoPA-ready for the Q2 2026 period. All 47 declared processing activities have a current lawful-basis envelope; the 3 cross-border transfers carry signed Art 44-49 mechanism evidence. 1 DSAR (received 2026-04-18) was answered in 22 days with a signed dsar_evidence_pack. No erasure backlog.
Supporting findings
- Processing inventory · 47 activities active · 0 missing lawful basis · 12 high-risk DPIA-required (all DPIAs current).
- Cross-border transfers · 3 active (US, Canada, Singapore) · all carry signed
kye.lawful_basis.v1envelopes citing SCCs + adequacy determinations. - DSAR queue · 1 received · 1 answered · median response 22 days · 0 erasure backlog · all rights-of-data-subject flows audit-chained.
- Consent records · 11,247 active · 388 withdrawn (all withdrawals propagated to downstream processors within 24h).
- Sub-processors · 18 declared · 0 changes this period · all carry current Art 28 contracts.
Framework binding
| Clause | KYE™ artefact that binds it |
|---|---|
| Art 30 — Record of Processing Activities | Evidence Pack™ per activity, signed. |
| Art 32 — Security of processing | Audit-chain append-only triggers + per-tenant signing kid registry. |
| Art 35 — DPIA | data_use_manifest.v1 with DPIA flag; signed when high-risk. |
| Art 44-49 — Cross-border transfers | Signed lawful-basis envelope on every cross-border call. |
| Art 15-22 — Rights of data subject | dsar_evidence_pack.v1 — signed pack with chain-of-custody. |
Signature
The bytes of this page are the canonical artefact; the signature fragment below binds them.
{
"schema_id": "kye.report.v1",
"report_id": "kye:report:gdpr_art30_ropa:sample-acme:2026Q2",
"tenant_id": "kye:tenant:sample",
"report_kind": "gdpr_art30_ropa",
"framework": "gdpr",
"period_start": "2026-04-01T00:00:00Z",
"period_end": "2026-07-01T00:00:00Z",
"sealed_at": "2026-07-01T00:00:00Z",
"assembler_kid": "kye:kid:sample-acme:dpo-q2-2026",
"signature_b64": "MEUCIQDxRy…(truncated; sample)…"
}