GDPR Art. 30 records of processing: do you automate the inventory or maintain it manually?
We're hitting the wall with Art. 30 RoPA maintenance. Our processing inventory spans 12 systems (CRM, analytics, support, marketing automation, data warehouse, etc.), and each team updates their own slice with no central oversight. Specific problems: - Marketing added a new CDP integration 3 months ago, nobody updated the RoPA - Our legal team wants a quarterly review cycle, but engineering says that's too slow for their sprint cadence - The DPA can request the full Art. 30 inventory at any time — we have 30 days to produce it How are teams operationalizing this? Any experience with automated discovery tools that can actually map processing activities, or is this fundamentally a human-driven exercise? Bonus question: Does anyone tie their Art. 30 records directly to their DPIA register, or are those maintained separately?