dpo-reporting

# DPO Reporting ## Cardinal Rule **Every DSR is a deadline. Every incident is a stopwatch. Every disclosure has a signed trail.** Anything less is a report you can't defend, a deadline you missed, or an incident you'll regret. ## The four DPO deliverables | Deliverable | Source | Cadence | Audience | |---|---|---|---| | **Registro de Operações (Art. 37)** | pii-inventory + consent_events + processing log | continuous; snapshot quarterly | ANPD on request; internal DPO | | **RIPD (Art. 38)** | RIPD template per processing activity | before launching new processing; reviewed yearly | internal DPO; ANPD on request | | **DSR response log** | DSR endpoint telemetry | continuous | requesting user + DPO | | **Incident notification** | incident response runbook | within 72 h of confirmed incident | ANPD + affected users | ## DSR response SLAs | DSR type (LGPD Art. 18) | SLA | Notes | |---|---|---| | Acesso (confirm + copy) | 15 calendar days | Extendable once by 15d with justification | | Correção | 15 calendar days | — | | Anonimização / bloqueio / eliminação | 15 calendar days | Subject to legal retention holds | | Portabilidade | 15 calendar days | Machine-readable format (JSON or CSV) | | Informação sobre compartilhamentos | 15 calendar days | From pii-inventory egress map | | Informação sobre recusa de consentimento | 15 calendar days | Explain consequences of refusal | | Revogação de consentimento | 24 h propagation (internal SLA; LGPD is "without undue delay") | Cascades...