Fill the RoPA — the legal calls

The data work is done: Regixo mapped your systems and filled in the mechanical facts. What remains are the judgments only a person can make — a lawful basis for each activity, retention, and the sensitive-data grounds. Regixo suggests a starting point for each; you decide, confirm, and sign.

The fields you fill

Each processing activity has these legal fields. The mechanical ones (data categories, role, the transfers suggestion) are already filled from the map; the rest are yours.

Lawful basis (Article 6(1))

Every activity needs exactly one Article 6(1) ground. These are the six, exactly as Regixo labels them, with a plain-English gloss:

How Regixo suggests one

Regixo reads the activity’s table names and offers a starting suggestion when it recognises a pattern. It’s a transparent heuristic, not a legal engine:

Special category — Article 9(2)

Some data is extra-sensitive: health, ethnicity, religion, political opinions, trade-union membership, biometrics, sexual orientation. When Regixo detects it (its own Art. 9 badge), the activity needs a second ground under Article 9(2) in addition to your Article 6 basis. The ten grounds, exactly as Regixo lists them:

The Art. 9 ground is a separate field from the lawful basis, so your Article 6 basis stays a clean single choice.

Criminal-offence data — Article 10

Data about criminal convictions or offences (its own Art. 10 class, never an Art. 9 ground) may only be processed under official authority or where authorised by Union or Member-State law. Regixo asks you to confirm that condition — it never proposes an Art. 9 ground for it.

Retention

How long you keep the data, and why. Regixo suggests a common default when the activity is recognisable — you confirm or replace it:

• Billing / invoices → 7 years (statutory tax retention)
• Employee records → 6 years after leaving (varies by member state)
• Marketing → until consent is withdrawn
• Logs / sessions → 30–90 days
• Customer accounts → account lifetime + statutory minimum

No recognisable pattern → the field is needs you. Set a concrete period tied to a reason, not “as long as necessary”.

Transfers, recipients, subjects, security

Transfers outside the EU

Auto-suggested from each source’s region — “None identified” when every source is in the EU, or “Yes — a source is hosted outside the EU” otherwise. Confirm or correct it, and note the safeguard (e.g. Standard Contractual Clauses) if data does leave.

Recipients

Who the data is disclosed to (processors, authorities). Regixo suggests the destination systems it can trace from cross-system lineage; you confirm those and add the rest. Enter categories, comma-separated.

Data subjects

Whose data it is — customers, employees, patients. Categories, not names.

Security measures

How the data is protected. Never auto-filled — describe your controls, or set them once in your organisation profile so they apply across activities.

How to fill & confirm

Filling and confirming happen on the claimed record. Read it signed out and every open legal call already shows itself: the value is blank, the badge says needs you, and a + Fill this link sits beside it. Signed out that link takes you to sign-in; signed in, it opens an editor in place. One activity, read signed out — Recipients and Security measures are still open, Retention has already been confirmed by a person:

Here is a legal-basis row mid-fill — the inline editor open on the lawful-basis call, with the approver's confirm checkbox:

Where each surface lands — and the honest limit of each:

$ regixo annotate set <activityKey> lawfulBasis "Art. 6(1)(b) contract" --confirm

Two ways to make the calls, depending on who you are:

In the portal (the compliance team)

Open each activity on your claimed record, choose the field’s value, and confirm. Roles apply: a preparer fills the fields; an approver confirms and signs. A confirmed field records who confirmed it and when.

From your project (the engineer, optional)

An engineer can pre-fill or confirm legal fields from the terminal with regixo annotate. Confirming requires a signer identity, so the record knows who made the call:

$ export REGIXO_SIGNER_EMAIL=dpo@acme.example
$ regixo annotate set <activityKey> lawfulBasis "Art. 6(1)(b) contract" --confirm

Rebuild the draft files — regixo report

regixo report re-reads the catalog and rewrites the draft files on disk, stamped DRAFT. You rarely need it — everything that reads the catalog live is already current the moment you save: the portal at regixo open, and the record regixo invite sends. Both rebuild the draft on the spot.

The files on disk do not. regixo start and regixo watch write RoPA_DRAFT.json. The human-readable RoPA_DRAFT.html — the one you would actually email someone — is written in one place only: here.

$ regixo report

RoPA DRAFT → ./RoPA_DRAFT.json (3 activities, stamped DRAFT)
auto-filled 14 field(s) · 10 need you · 0 special-category (Art. 9) · coverage 2/4 sources
read it: open RoPA_DRAFT.html