typeform.com — 6 marketing accounts since 4 Aug
Art. 30 · record of processing activitieskept current, not rebuilt once a year
Your RoPA,
built in minutes and
kept current.
When your business changes, your RoPA changes with it. Routine updates are handled automatically; anything requiring legal judgement comes to you.
§ 1 One ordinary week, filed
Art. 5(2) · accountabilityWhat landsSingle sign-on logOkta · 20 Aug Supplier invoicePennylane export · 14 Aug Sub-processor noticeaws.amazon.com/compliance · 16 Aug Retention policyApproved by you · 21 Aug
Zendesk Inc. — $1,240, support plan renewed
One US sub-processor added — 30 days to object
Support tickets: 5 years → 3 years
Legiscope assessmentRead against your register · Art. 30
What changed in the registerNew activityYour decision UpdateFiled automatically
Customer surveysP-021 · controller record
Typeform has been in use by marketing since 4 August. No record covered it.
- Art. 30(1)(b)purposes
- Measure satisfaction after an order
- Art. 30(1)(c)categories
- E-mail, order reference, free text
- Art. 30(1)(d)recipients
- Typeform France SAS — no Art. 28 DPA
- Art. 30(1)(f)time limits
- Not established
4 of 7 fields drafted · basis and retention left to you
Support recordsP-011 · controller record
The policy you approved on 21 August contradicted the period on this record.
- Art. 30(1)(f)time limits
5 years→3 years- Art. 30(1)(e)recipients
- Unchanged — Zendesk Inc., processor
Filed on its own · version 12, dated 21 Aug · policy kept
None of these were sent to you. They were an invoice, a status page, a log line and a release note — and every one of them moved something in the register. What the assessment can settle on the record is settled; what turns on a legal call is held.
§ 2 Three minutes, not five weeks
Art. 30(1) · controller recordNo register at all?
Three minutes, not five weeks.
A company that has never written an Article 30 register normally spends about five weeks on the first one: interviews with every team, a template nobody likes, and a document that is out of date by the last interview. Describe the business in three lines instead, and read the draft it writes.
What you said
34 activities written“We sell French kitchen equipment — a shop in Paris, an online store, cooking workshops and a loyalty programme”
Processing activityWhat it is for — Art. 30(1)(b)Lawful basisHow longWho else sees it
Retail salesShop · Paris 11eComplete the sale, issue the receipt and honour the legal warranty.Art. 6(1)(b)contract3 years10 for the accountsPayment provider
Online ordersE-commerceTake the order, collect payment and get the parcel to the customer.Art. 6(1)(b)contract3 yearsfrom the last orderCarrier · payments
Loyalty programmeLes Amis de CuisineAward and redeem points, and send members the offers they signed up for.Art. 6(1)(a)consent3 yearsafter last activityMarketing platform
Cooking workshopsShop · atelierManage bookings, allergies and attendance on the day.Art. 6(1)(b)contract1 yearallergies soonerBooking platform
Returns, after-salesShop · e-commerceHandle withdrawal, exchange and warranty claims, and manufacturer recalls.Art. 6(1)(c)legal obligation5 yearslimitation periodManufacturer
NewsletterMarketingSend recipes, product news and offers to people who asked for them.Art. 6(1)(a)consentUntil withdrawal3 years if inactiveEmail platform
PayrollHR · 24 staffPay the staff, run the declarations and keep the employment file.Art. 6(1)(c)legal obligation5 years50 for pension proofAccountant · URSSAF
CCTVShop · stockroomProtect the goods and the till area against theft.Art. 6(1)(f)legitimate interest30 daysCNIL guidanceSecurity provider
1–8 of 34 activities · Art. 30(1) controller recordWritten from 121 sources · every entry keeps the one it came from
§ 3 The problem this solves
and why registers stop being trueYour business changes.
Your RoPA keeps up.
Legiscope keeps routine information current, preserves the source behind every change, and brings decisions requiring legal judgement to you.
Outdated as soon as the business changes.
A new supplier, purpose or retention rule appears. The RoPA waits for the next review—and stops reflecting the business in the meantime.
With LegiscopeNew information becomes a proposed update as it arrives. Routine changes are recorded; anything requiring legal judgement waits for your review.
An answer nobody can explain.
The register says “3 years,” but not where it came from, when it changed or who approved it. During an inspection, the answer alone is not enough.
With LegiscopeEvery entry keeps its source, date and review status, so the record can be verified and defended.
The privacy team cannot record what it never sees.
New tools, suppliers and uses of personal data appear across the organisation without reaching the RoPA owner.
With LegiscopeWhen new processing appears in the information you provide or connect, Legiscope drafts the activity, completes what can be established and flags what still needs your input.
See Legiscope in actionMake compliance
Make compliance
operational.
See how Legiscope turns GDPR obligations into clear processes your team can execute, review and evidence.
Book your demo →