DPA Review, Article 30 Records and Data Flow Mapping

An Article 30 record built from a vendor spreadsheet describes a company that does not exist. I build records from the traffic and the systems: what leaves your site, your CRM and your warehouse, to which legal entity, under which signed agreement. The gap between the record and the reality is where enforcement risk sits, most often a processor whose contracting entity is in one country while the receiving infrastructure is in another, or a transfer running on Standard Contractual Clauses Module Two when the relationship is controller to controller and needs Module One. Map first, contracts second: Documentation written before the mapping finishes is fiction with a version number. The sequence is fixed: observed and interviewed data flows, then the records describing them, then the agreements read against the records. Anyone quoting a page count before seeing your flows is selling a template, and templates are how a company ends up formally attesting to processing it does not perform. What you receive: A processing record under Article 30 and its Law 25 equivalent, written per activity rather than per system, with purpose, categories, recipients, retention and basis populated from evidence. A data flow map at field level, showing where each identifier originates, every system it reaches, and where it stops. A transfer register: one row per cross-border flow, naming the mechanism, the exporting and importing entities, and the date the mechanism was last verified. A gap schedule on your executed agreements, read clause by clause against Article 28(3), marked for what is absent, what is out of date, and where the named entity does not match the observed one. A retention schedule a system owner can implement, with the deletion job named rather than the intention stated. Assessments where the threshold is genuinely met, and a written note where it is not, because the note is also a record. Transfers get verified, not assumed: Data Privacy Framework status is checked against the active list per legal entity rather than per brand, and certifications lapse. Transfer assessments are written in proportion to the flow: an assessment of a support tool that sees a name and an email address should not run the same forty pages as the one covering your event stream, and identical language repeated across twelve vendors tells a regulator that none of them was assessed. Quebec: Law 25 requires an assessment before personal information is communicated outside the province, and it is a different instrument from a GDPR data protection impact assessment with a different test. Where French-language documentation is required, I write it in French rather than translating the English version afterwards. Employment and logistics flows: Where the processing is applicant tracking, workforce monitoring or vehicle telematics, the records carry the obligations those attract rather than a marketing template with the nouns changed: automated decision disclosure under Article 22 and its Law 25 counterpart, the New York City bias audit requirement for automated employment decision tools, and the EU AI Act's high-risk employment duties. The point is that the record you file now is not rewritten in a year. Not included: I do not negotiate your contracts, draft clauses, or act as your data protection officer or privacy officer. Findings go to your counsel with the evidence attached and counsel decides. Nothing I produce is legal advice or privileged, and that sits on page one rather than in a footer. Not for you if: There is an audit on Friday and what is wanted is paper by Thursday. Records assembled that way become a written admission at the next inspection, and I would rather decline than hand you one.