ropa-completeness-audit

RoPA Completeness Audit

Overview

Supervisory authorities across the EEA publish RoPA templates and guidance that extend beyond the bare minimum Art. 30(1) requirements. While Art. 30(1) mandates seven fields, supervisory authorities such as CNIL, ICO, and BfDI expect additional information in practice. This skill provides a methodology for auditing RoPA entries against these expanded expectations, calculating completeness scores, identifying gaps, and tracking remediation to achieve supervisory authority readiness.

Supervisory Authority Template Comparison

CNIL (France) Template

The CNIL publishes the most structured RoPA template in the EU, available in both PDF and machine-readable (CSV/JSON) format. The CNIL template requires the Art. 30 mandatory fields plus additional recommended fields:

ICO (United Kingdom) Template

The ICO template aligns with UK GDPR Art. 30 and includes guidance notes for each field:

BfDI (Germany) Template

The German Federal Commissioner for Data Protection (BfDI) publishes guidance (Hinweise zum Verzeichnis von Verarbeitungstaetigkeiten) with sector-specific requirements:

Completeness Scoring Methodology

Scoring Framework

Each RoPA entry is scored against a three-tier assessment:

1. Tier 1 — Art. 30 Mandatory Compliance (40% weight): Are all seven Art. 30(1) mandatory fields populated?
2. Tier 2 — Supervisory Authority Expectations (35% weight): Does the entry meet the selected SA's expanded requirements?
3. Tier 3 — Quality Assessment (25% weight): Are populated fields specific, accurate, and current?

Tier 1: Mandatory Field Scoring

Quality scoring criteria:

• 0 (Missing): Field is empty or contains only "N/A" where substantive content is expected.
• 1 (Partial): Field contains some content but is materially incomplete (e.g., "employees" without further granularity for data subjects).
• 2 (Complete): Field satisfies the legal requirement with specific, substantive content.
• 3 (Excellent): Field exceeds minimum requirements with cross-references, supporting detail, and regulatory alignment.

Tier 2: SA-Specific Field Scoring

Score additional fields required or recommended by the target SA. Each SA template adds 3-6 fields beyond Art. 30 minimums.

Tier 3: Quality Metrics

Overall Completeness Score Calculation

Tier 1 Score = (fields present / 8) * (avg quality / 3) * 100
Tier 2 Score = (SA fields present / SA total fields) * (avg quality / 3) * 100
Tier 3 Score = (sum of quality metrics / max possible) * 100

Overall = (Tier 1 * 0.40) + (Tier 2 * 0.35) + (Tier 3 * 0.25)

Readiness thresholds:

Gap Identification Process

Step 1: Template Selection

Select the primary supervisory authority template based on:

• The country where the controller is established (lead SA under one-stop-shop)
• Any pending investigations or correspondence with a specific SA
• Regulatory expectations in the primary market

Step 2: Field-by-Field Comparison

For each RoPA entry, compare every field against the selected SA template and classify:

Step 3: Gap Register

Compile all identified gaps into a structured register:

Remediation Tracking

Remediation Workflow

1. Gap register creation: Compile all gaps from the audit into the register.
2. Prioritisation: Sort by severity (Critical > Major > Minor > Enhancement).
3. Owner assignment: Assign each gap to the processing owner responsible for the affected entry.
4. Deadline setting: Critical = 30 days, Major = 60 days, Minor = 90 days, Enhancement = next annual review.
5. Progress tracking: Weekly status updates on Critical items, bi-weekly on Major items.
6. Verification: DPO verifies each remediated gap before closing.
7. Re-scoring: After remediation cycle, re-calculate completeness scores.

Remediation Status Dashboard

Audit Frequency