Sample kye.report.v1 DPO view synthetic tenant

DPO Report™ — GDPR Art 30 RoPA & DSAR coverage.

A representative kye.report.v1 envelope for a Data Protection Officer. The bytes you see are signature-covered — anyone with the published assembler_kid public key can verify the report locally, with no portal log-in and no vendor cooperation.

Synthetic tenant. Real reports carry tenant-PII and are scoped to the customer's admin console. Mechanism details are part of the patent track and not disclosed in this repository.

Executive verdict

Acme Ltd is GDPR Art 30 RoPA-ready for the Q2 2026 period. All 47 declared processing activities have a current lawful-basis envelope; the 3 cross-border transfers carry signed Art 44-49 mechanism evidence. 1 DSAR (received 2026-04-18) was answered in 22 days with a signed dsar_evidence_pack. No erasure backlog.

Supporting findings

  1. Processing inventory · 47 activities active · 0 missing lawful basis · 12 high-risk DPIA-required (all DPIAs current).
  2. Cross-border transfers · 3 active (US, Canada, Singapore) · all carry signed kye.lawful_basis.v1 envelopes citing SCCs + adequacy determinations.
  3. DSAR queue · 1 received · 1 answered · median response 22 days · 0 erasure backlog · all rights-of-data-subject flows audit-chained.
  4. Consent records · 11,247 active · 388 withdrawn (all withdrawals propagated to downstream processors within 24h).
  5. Sub-processors · 18 declared · 0 changes this period · all carry current Art 28 contracts.

Framework binding

ClauseKYE™ artefact that binds it
Art 30 — Record of Processing ActivitiesEvidence Pack™ per activity, signed.
Art 32 — Security of processingAudit-chain append-only triggers + per-tenant signing kid registry.
Art 35 — DPIAdata_use_manifest.v1 with DPIA flag; signed when high-risk.
Art 44-49 — Cross-border transfersSigned lawful-basis envelope on every cross-border call.
Art 15-22 — Rights of data subjectdsar_evidence_pack.v1 — signed pack with chain-of-custody.

Signature

The bytes of this page are the canonical artefact; the signature fragment below binds them.

{
  "schema_id":     "kye.report.v1",
  "report_id":     "kye:report:gdpr_art30_ropa:sample-acme:2026Q2",
  "tenant_id":     "kye:tenant:sample",
  "report_kind":   "gdpr_art30_ropa",
  "framework":     "gdpr",
  "period_start":  "2026-04-01T00:00:00Z",
  "period_end":    "2026-07-01T00:00:00Z",
  "sealed_at":     "2026-07-01T00:00:00Z",
  "assembler_kid": "kye:kid:sample-acme:dpo-q2-2026",
  "signature_b64": "MEUCIQDxRy…(truncated; sample)…"
}

verified Verify a real envelope offline →