The processor record — Article 30(2)

If your company handles personal data on a client’s behalf, GDPR asks you for a second, separate record — not a section of your own.

Article 30(2) shapes it differently on purpose: it is organised per client, and it has no purpose, no lawful basis, no retention and no data-subject categories. Those calls belong to your client, not to you.

Regixo drafts it from two things you declare, and marks the rest as yours.

Land here from: Understand the record (your own Article 30(1) record). You need this page only if you act as a processor for someone else — a SaaS company hosting customer data, an agency running a client’s systems, a payroll bureau.

1 · Do you need this record at all?

One question decides it: for the data in this system, who decides why it is used?

Being a processor is a fact about a relationship, not something a scanner can detect. Regixo never guesses it — you declare it, and the next two steps are that declaration.

2 · Declare how your company acts

The goal: Regixo drafts the Article 30(2) record only once you say you act as a processor. Until then nothing changes, and existing setups are untouched — the default is controller.

You edit regixo.yml yourself — it is a declaration about your company. Your agent can do the re-draft afterwards.

$ # set it in regixo.yml, then re-draft
$ regixo report      # re-draft only · regixo start also re-scans

actsAs: both        # controller (default) · processor · both

How to check it worked: restart the portal, then open the Compliance ▾ menu — it gains a Processor record entry, “Art. 30(2) — processing you run for clients”. The portal reads actsAs at start-up, so one that was already running will not show it until it restarts.

Open it before you have declared any client and the page says so itself: “No sources are declared role: processor with a processorFor client yet — declare them in regixo.yml and re-run regixo start.” That is step 3.

3 · Say whose data each source holds

The goal: the record is organised per client, so every processor-role source has to name the client whose data it holds. Two per-source declarations do it.

  - id: client-warehouse
    kind: sql
    driver: snowflake
    connectionRef: SNOWFLAKE_URL
    region: eu-west-1
    role: processor                    # this system holds someone else's data
    processorFor: "Northwind Retail Oy" # whose

A source declared role: processor with no processorFor is not guessed onto a client and not dropped — it lands in an unassigned bucket as an open call, so you see it and fix it. The record says so in its own words:

These sources are declared processor-role but name no controller — add
`processorFor: "<client>"` to each in regixo.yml so its processing lands on
that client's section.

4 · What the record contains — and what it deliberately omits

An Article 30(2) record is not a copy of your own record with the names changed. It carries these, per client:

5 · Answer your part

The goal: close the open calls. They are addressed by client, using the key processor:<client> — the client’s declared name, so the key survives every re-scan.

$ regixo annotate list
$ regixo annotate set "processor:Northwind Retail Oy" securityMeasures "…"

The five fields you can fill on a client section are controllerContact · processingCategories · transfersOutsideEU · transferSafeguard · securityMeasures. Ask for purpose, lawfulBasis or retention here and Regixo refuses by name — they are not fields on this record.

--confirm records an answer as a named person’s act, and --why records the reasoning behind it. Both work exactly as they do on your own record — same rules, same attribution, same store. See Fill the RoPA for how confirming works.

6 · What is not built

How you know the record is finished

• Every client you process for has a section — and no source sits in the unassigned bucket.
• Each section shows no needs you rows: the contact, the categories of processing, the transfer answer and the security measures are all filled.
• The summary line at the top reads 0 fields need you.
• The draft is written next to your other records as RoPA_PROCESSOR_DRAFT.json and the readable RoPA_PROCESSOR_DRAFT.html — regixo report writes both.