Group Structure Ropa

Group Structure RoPA

Overview

GDPR Art. 30 applies to each controller and each processor individually. In a corporate group comprising a holding company, operating subsidiaries, shared service centres, and joint ventures, each entity that independently determines purposes and means of processing must maintain its own Art. 30(1) records. Entities acting as processors for group companies must maintain Art. 30(2) records. This skill addresses the complexities of group-level RoPA management including entity hierarchy, intra-group data flows, shared processing activities, and consolidated governance.

Corporate Group Structure — Helix Biotech Solutions

Helix Biotech Holdings SE (Netherlands — Holding)
├── Helix Biotech Solutions GmbH (Germany — Primary Operating Entity)
│   ├── Controller for: own employees, clinical trials, marketing
│   └── Processor for: group shared services (see below)
├── Helix Biotech Solutions Ltd (United Kingdom — UK Subsidiary)
│   ├── Controller for: own employees, UK customer data, UK clinical sites
│   └── Joint controller with GmbH for: multi-country clinical trials
├── Helix Biotech Solutions Inc. (United States — US Subsidiary)
│   ├── Controller for: own employees, US customer data
│   └── Processor for: global pharmacovigilance data processing (under GmbH instruction)
├── Helix Shared Services B.V. (Netherlands — Shared Service Centre)
│   ├── Processor for: group-wide IT infrastructure, payroll processing
│   └── Controller for: own employees only
└── Helix Biotech Diagnostics S.A.S. (France — Acquired Entity)
    ├── Controller for: own employees, diagnostic service customers
    └── Integration pending — separate RoPA maintained

Entity-Level vs Group-Level Records

Entity-Level RoPA (Required)

Each legal entity must maintain its own RoPA containing processing activities for which it is controller or processor. This is a legal obligation that cannot be satisfied by a group-level record alone.

Group-Level Consolidated View (Recommended)

In addition to entity-level records, maintain a consolidated group view that:

1. Aggregates all entity-level RoPA entries into a single searchable register.
2. Highlights intra-group data flows and transfer arrangements.
3. Identifies shared processing activities and joint controller arrangements.
4. Supports group-level reporting to the board and supervisory authorities.
5. Enables gap analysis across entities (e.g., one entity has incomplete records).

The consolidated view is not a legal substitute for entity-level records but serves governance and oversight purposes.

Intra-Group Data Flows

Controller-to-Controller Transfers

When one group entity transfers personal data to another group entity and each determines its own purpose for the processing, this is a controller-to-controller transfer requiring:

• Legal basis: Art. 6(1) lawful basis for the disclosure (typically Art. 6(1)(f) legitimate interest with intra-group LIA)
• Transfer mechanism: If the receiving entity is outside the EEA, an appropriate Chapter V safeguard (SCCs, BCRs, adequacy decision)
• RoPA documentation: Both entities must record the transfer in their respective RoPAs — the disclosing entity as a recipient under Art. 30(1)(d), the receiving entity as data source documentation

Example:

Helix Biotech Solutions GmbH (Germany) shares employee directory data with Helix Biotech Solutions Inc. (US) for internal communications.

Controller-to-Processor Transfers (Intra-Group)

When a group shared service centre processes data on behalf of another group entity, the relationship is controller-to-processor even though both entities are in the same corporate group:

• Art. 28 DPA required: An intra-group DPA is required between the controller entity and the processor entity, even within the same group.
• RoPA documentation: The controller entity records the shared service centre as a processor in Art. 30(1)(d). The shared service centre records the controller entity in its Art. 30(2)(a) processor records.

Example:

Helix Shared Services B.V. (Netherlands) processes payroll for all group entities.

Joint Controller Arrangements (Art. 26)

When two or more group entities jointly determine the purposes and means of processing, they are joint controllers under Art. 26:

• Art. 26 arrangement required: Formal arrangement determining respective responsibilities.
• RoPA documentation: Each joint controller records the arrangement in Art. 30(1)(a) with cross-reference to the Art. 26 arrangement.

Example:

Helix Biotech Solutions GmbH and Helix Biotech Solutions Ltd jointly conduct multi-country clinical trials and jointly determine the trial protocol, data collection methods, and analysis purposes.