Article 35 requires a DPIA before processing that is "likely to result in a high risk" to the rights and freedoms of individuals. Mandatory triggers include:
 

• Systematic and extensive profiling used to make decisions with legal or similarly significant effects
  
  
• Large-scale processing of special category data
  
  
• Systematic monitoring of publicly accessible areas

OneTrust assesses DPIA triggers within the privacy assessment workflow, mapping proposed processing activities against Article 35 criteria and applicable DPA risk lists. When a threshold is met, a DPIA is initiated automatically, pre-populated with the relevant processing details, and routed for DPO review.

Article 30(1) requires controllers to maintain a written record containing: 
 

• The name and contact details of the controller and DPO
  
  
• The purposes of processing
  
  
• A description of categories of data subjects and personal data
  
  
• Categories of recipients of personal data
  
  
• Details of any transfers to third countries and the safeguards applied
  
  
• Planned retention periods
  
  
• General description of technical and organizational security measures

Article 30(2) imposes an equivalent obligation on processors. Both sets of records must be made available to supervisory authorities on request.
 

OneTrust generates and maintains this record automatically, drawing from assessment responses, system integrations, and bulk imports. As processing activities change, the RoPA updates in place rather than requiring manual refresh each time a system, vendor, or data flow changes.

A Record of Processing Activities is a formal legal document required by Article 30 — a structured statement of how personal data is processed, maintained for regulatory inspection. A data inventory is the operational process of discovering and cataloging where personal data exists across systems, applications, and vendors. A data map visualizes data flows and lineage across the organization.
 

The three serve different purposes but need to stay in sync: a change in your data inventory (a new system, a new vendor, a changed retention period) should trigger an update to your RoPA. OneTrust connects the processing inventory to assessment workflows and system integrations so changes discovered during data mapping propagate to the live RoPA record, rather than sitting in a separate spreadsheet that goes stale.
 

From Article 30 records to data subject rights fulfillment, OneTrust connects every GDPR obligation into a single accountability program your DPO can defend and your Data Protection Authority can audit.

GDPR is not equivalent to CCPA, LGPD, or other national frameworks, but they share foundational principles: data subject rights, purpose limitation, data minimization, accountability, and transparency. Building a GDPR-compliant program provides a strong baseline for multi-jurisdiction compliance because it typically exceeds the requirements of less stringent frameworks on key controls.

OneTrust supports multi-framework compliance mapping so organizations can document where a single control satisfies obligations under GDPR, CCPA, and LGPD simultaneously, and where jurisdiction-specific configurations are required, rather than maintaining separate compliance programs for each regulation.

GDPR compliance is not static. The regulation itself has been supplemented by EDPB guidelines, national DPA enforcement decisions, adequacy rulings, and the evolving enforcement priorities of individual supervisory authorities. Organizations operating across multiple EU member states also face variation in how national DPAs interpret and apply GDPR requirements.

Practically, this means compliance teams need a mechanism to: monitor EDPB guidance as it is issued; track DPA enforcement decisions relevant to their processing activities; update internal policies and controls when guidance changes; and communicate those updates to the teams responsible for implementation.

OneTrust connects your privacy program to a continuously updated regulatory library, so changes in enforcement guidance can be surfaced against your existing policy and control structure rather than requiring a manual gap analysis from scratch.

Article 5(2) places the burden of proof on the controller: you must not only comply with the data protection principles set out in Article 5(1), but be able to demonstrate that compliance on request. Article 24 requires controllers to implement appropriate technical and organizational measures and to be able to show that processing is performed in accordance with the regulation.

In practice, supervisory authorities interpret "demonstrable accountability" through a consistent set of evidentiary expectations: a documented processing inventory that reflects operational reality; written DPIAs for high-risk processing, with evidence that risks were assessed and decisions recorded; consent records that show each individual's transaction history and the mechanism used; data subject request logs showing intake, routing, response, and timing; processor agreements and evidence of ongoing oversight; and records of any security incidents and the actions taken.

The accountability standard is not satisfied by documentation produced after a complaint is filed. Regulators assess whether records were maintained as a matter of program discipline, not reconstructed for enforcement. OneTrust creates and maintains the documentary record across each of these areas — RoPA, DPIA, consent receipts, DSAR logs, vendor assessments, and incident records — so that evidence is available when requested, not assembled in response to a request.