Group Structure Ropa

Group Structure RoPA

Overview

GDPR Art. 30 applies to each controller and each processor individually. In a corporate group comprising a holding company, operating subsidiaries, shared service centres, and joint ventures, each entity that independently determines purposes and means of processing must maintain its own Art. 30(1) records. Entities acting as processors for group companies must maintain Art. 30(2) records. This skill addresses the complexities of group-level RoPA management including entity hierarchy, intra-group data flows, shared processing activities, and consolidated governance.

Corporate Group Structure — Helix Biotech Solutions

Helix Biotech Holdings SE (Netherlands — Holding)
├── Helix Biotech Solutions GmbH (Germany — Primary Operating Entity)
│   ├── Controller for: own employees, clinical trials, marketing
│   └── Processor for: group shared services (see below)
├── Helix Biotech Solutions Ltd (United Kingdom — UK Subsidiary)
│   ├── Controller for: own employees, UK customer data, UK clinical sites
│   └── Joint controller with GmbH for: multi-country clinical trials
├── Helix Biotech Solutions Inc. (United States — US Subsidiary)
│   ├── Controller for: own employees, US customer data
│   └── Processor for: global pharmacovigilance data processing (under GmbH instruction)
├── Helix Shared Services B.V. (Netherlands — Shared Service Centre)
│   ├── Processor for: group-wide IT infrastructure, payroll processing
│   └── Controller for: own employees only
└── Helix Biotech Diagnostics S.A.S. (France — Acquired Entity)
    ├── Controller for: own employees, diagnostic service customers
    └── Integration pending — separate RoPA maintained

Entity-Level vs Group-Level Records

Entity-Level RoPA (Required)

Each legal entity must maintain its own RoPA containing processing activities for which it is controller or processor. This is a legal obligation that cannot be satisfied by a group-level record alone.

Group-Level Consolidated View (Recommended)

In addition to entity-level records, maintain a consolidated group view that:

1. Aggregates all entity-level RoPA entries into a single searchable register.
2. Highlights intra-group data flows and transfer arrangements.
3. Identifies shared processing activities and joint controller arrangements.
4. Supports group-level reporting to the board and supervisory authorities.
5. Enables gap analysis across entities (e.g., one entity has incomplete records).

The consolidated view is not a legal substitute for entity-level records but serves governance and oversight purposes.

Intra-Group Data Flows

Controller-to-Controller Transfers

When one group entity transfers personal data to another group entity and each determines its own purpose for the processing, this is a controller-to-controller transfer requiring:

• Legal basis: Art. 6(1) lawful basis for the disclosure (typically Art. 6(1)(f) legitimate interest with intra-group LIA)
• Transfer mechanism: If the receiving entity is outside the EEA, an appropriate Chapter V safeguard (SCCs, BCRs, adequacy decision)
• RoPA documentation: Both entities must record the transfer in their respective RoPAs — the disclosing entity as a recipient under Art. 30(1)(d), the receiving entity as data source documentation

Example:

Helix Biotech Solutions GmbH (Germany) shares employee directory data with Helix Biotech Solutions Inc. (US) for internal communications.

Controller-to-Processor Transfers (Intra-Group)

When a group shared service centre processes data on behalf of another group entity, the relationship is controller-to-processor even though both entities are in the same corporate group:

• Art. 28 DPA required: An intra-group DPA is required between the controller entity and the processor entity, even within the same group.
• RoPA documentation: The controller entity records the shared service centre as a processor in Art. 30(1)(d). The shared service centre records the controller entity in its Art. 30(2)(a) processor records.

Example:

Helix Shared Services B.V. (Netherlands) processes payroll for all group entities.

Joint Controller Arrangements (Art. 26)

When two or more group entities jointly determine the purposes and means of processing, they are joint controllers under Art. 26:

• Art. 26 arrangement required: Formal arrangement determining respective responsibilities.
• RoPA documentation: Each joint controller records the arrangement in Art. 30(1)(a) with cross-reference to the Art. 26 arrangement.

Example:

Helix Biotech Solutions GmbH and Helix Biotech Solutions Ltd jointly conduct multi-country clinical trials and jointly determine the trial protocol, data collection methods, and analysis purposes.

Binding Corporate Rules (BCRs) and Group RoPA

If the group has approved BCRs under Art. 47, the RoPA transfer fields (Art. 30(1)(e)) should reference the BCRs as the transfer mechanism for intra-group transfers:

Group RoPA Governance Model

Centralised Governance with Local Execution

Governance Workflow

1. Entity-level creation: Each entity's privacy lead creates and maintains entity-level RoPA entries following group standards.
2. Group template: All entities use the same RoPA template and field definitions to ensure consistency.
3. Centralised aggregation: Entity-level records are aggregated into the group consolidated view quarterly.
4. Cross-entity review: Group DPO reviews the consolidated view for intra-group transfer completeness, joint controller arrangement consistency, and entity-level gap identification.
5. Board reporting: Group DPO presents consolidated RoPA metrics to the Holdings SE board annually.

Post-Acquisition Integration

When a new entity is acquired (e.g., Helix Biotech Diagnostics S.A.S.):

1. Immediate (Day 1): Identify the acquired entity's existing RoPA and assess its format, completeness, and quality.
2. 30 days: Conduct a gap analysis against the group RoPA template and identify intra-group data flows that will be established.
3. 60 days: Migrate the acquired entity's RoPA to the group template format.
4. 90 days: Establish intra-group DPAs for shared services and document intra-group transfers in both entities' RoPAs.
5. 6 months: Full integration into the group consolidated view and ongoing governance cycle.

Common Group Structure Pitfalls

1. Assuming a single group RoPA satisfies all entities: Each legal entity must have its own records. A group-level consolidated view does not replace entity-level obligations.

2. Missing intra-group DPAs: The GDPR does not exempt intra-group processing from the Art. 28 DPA requirement. A holding company providing IT services to subsidiaries must have DPAs in place.

3. Undocumented intra-group transfers: Data flows between group entities (shared directories, consolidated HR systems, group-wide analytics) are transfers that must be recorded in Art. 30(1)(d) and (e).

4. Inconsistent entity identification: Using trade names instead of legal entity names across different entities' RoPAs creates confusion during supervisory authority inspections.

5. Missing joint controller arrangements: When two group entities jointly determine processing purposes (e.g., a global marketing campaign managed by two subsidiaries), an Art. 26 arrangement is required but frequently overlooked within corporate groups.

6. One-stop-shop confusion: The lead supervisory authority under Art. 56 is determined by the location of the main establishment, not by where most processing occurs. Group RoPA must clearly identify each entity's establishment and the lead SA for cross-border processing.