{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Record of Processing Activities (Art. 30 GDPR)","description":"Article 30 GDPR register. Supports both controller records (Art. 30(1)) and processor records (Art. 30(2)) — set record_type accordingly and populate the matching fields on each activity.","type":"object","required":["record_type","controller","activities"],"additionalProperties":false,"properties":{"record_type":{"type":"string","enum":["controller","processor"],"description":"Art. 30(1) record for controllers; Art. 30(2) record for processors."},"version":{"type":"string","description":"Internal version tag for this revision of the register."},"reviewed_on":{"type":"string","format":"date"},"controller":{"type":"object","description":"The controller entity (or, for processor records, the processor producing this register).","required":["name","address","contact_email"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1},"address":{"type":"string"},"contact_email":{"type":"string","format":"email"},"representative":{"type":"string","description":"EU representative under Art. 27, if the controller is outside the EU."},"dpo":{"type":"object","description":"Data Protection Officer, when designated under Art. 37.","additionalProperties":false,"properties":{"name":{"type":"string"},"email":{"type":"string","format":"email"},"phone":{"type":"string"}}},"joint_controllers":{"type":"array","items":{"type":"string"},"description":"Names of joint controllers under Art. 26."}}},"activities":{"type":"array","minItems":1,"items":{"$ref":"#/$defs/activity"}}},"$defs":{"activity":{"type":"object","required":["name","purposes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"name":{"type":"string","minLength":1},"purposes":{"type":"array","items":{"type":"string"},"minItems":1,"description":"Art. 30(1)(b) — purposes of processing."},"legal_basis":{"type":"string","enum":["consent","contract","legal_obligation","vital_interests","public_task","legitimate_interests"],"description":"Art. 6(1) lawful basis."},"legitimate_interests_balancing":{"type":"string","description":"Required when legal_basis=legitimate_interests — summary of the balancing test."},"special_category_basis":{"type":"string","description":"Art. 9(2) condition, when special-category data is processed."},"data_subjects":{"type":"array","items":{"type":"string"},"description":"Categories of data subjects (employees, customers, job applicants, ...)."},"data_categories":{"type":"array","items":{"type":"string"},"description":"Categories of personal data processed."},"recipients":{"type":"array","items":{"type":"string"},"description":"Art. 30(1)(d) — categories of recipients, including sub-processors and public authorities."},"international_transfers":{"type":"array","items":{"type":"object","required":["country","safeguard"],"additionalProperties":false,"properties":{"country":{"type":"string"},"safeguard":{"type":"string","description":"e.g. 'Adequacy decision', 'SCCs 2021/914 Module 2', 'BCRs', 'Derogation Art. 49'."}}}},"retention_period":{"type":"string","description":"Retention period or criteria used to determine it (Art. 30(1)(f))."},"security_measures":{"type":"array","items":{"type":"string"},"description":"General description of technical and organisational measures (Art. 32)."},"processor_only":{"type":"object","description":"Fields used only in Art. 30(2) processor records.","additionalProperties":false,"properties":{"controller_represented":{"type":"string"},"processing_categories":{"type":"array","items":{"type":"string"}}}}}}}}