# Regulatory Correspondence Log

> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19


**Organization:** Acme Inc
**Project:** nextjs-saas-example
**Last updated:** 2026-03-19
**Maintained by:** Jane Mueller (dpo@acme-saas.com)

---

This document tracks all communications with regulatory authorities, including inquiries, complaints, audits, notifications, and follow-up actions. Maintaining a complete correspondence log is a GDPR accountability requirement (Art. 5(2)) and demonstrates good-faith compliance to supervisory authorities.

> **Retention:** Keep all correspondence records for a minimum of 6 years from the date of last communication. Store securely with restricted access.

## 1. Correspondence Register

Record every inbound and outbound communication with any regulatory authority.

| # | Date | Direction | Authority | Contact Person | Topic | Reference No. | Outcome | Follow-Up Required | Follow-Up Deadline | Status |
|---|------|-----------|-----------|----------------|-------|---------------|---------|--------------------|--------------------|--------|
| 1 | [DATE] | Inbound/Outbound | [AUTHORITY NAME] | [NAME/DEPT] | [BRIEF TOPIC] | [REF#] | [OUTCOME SUMMARY] | [YES/NO] | [DATE] | Open/Closed |
| 2 | [DATE] | Inbound/Outbound | [AUTHORITY NAME] | [NAME/DEPT] | [BRIEF TOPIC] | [REF#] | [OUTCOME SUMMARY] | [YES/NO] | [DATE] | Open/Closed |
| 3 | [DATE] | Inbound/Outbound | [AUTHORITY NAME] | [NAME/DEPT] | [BRIEF TOPIC] | [REF#] | [OUTCOME SUMMARY] | [YES/NO] | [DATE] | Open/Closed |

## 2. Communication Categories

| Category | Description | Typical Deadline |
|----------|-------------|------------------|
| **Data Breach Notification** | Mandatory notification under GDPR Art. 33 / state breach laws | 72 hours (GDPR), varies by state |
| **DSAR Escalation** | Regulator inquiry following unresolved data subject request | 30 days from regulator inquiry |
| **Complaint Investigation** | Formal investigation following a data subject complaint | Per authority timeline |
| **Audit / Inspection** | Planned or unplanned regulatory audit | Per audit schedule |
| **Proactive Consultation** | DPIA consultation (GDPR Art. 36) or voluntary disclosure | 8 weeks (GDPR Art. 36(2)) |
| **Annual Filing** | Required annual reports or registrations | Per jurisdiction |
| **Cross-Border Transfer** | Transfer mechanism notifications or approvals | Per mechanism |
| **AI Incident Report** | EU AI Act mandatory serious incident reports | 15 days (EU AI Act Art. 62) |

## 3. Relevant Regulatory Authorities

Authorities relevant to this project based on detected jurisdictions and services:

| Authority | Jurisdiction | Area | Contact | Notes |
|-----------|-------------|------|---------|-------|
| **PCI SSC** | International | Payment card data | pcisecuritystandards.org | PCI DSS compliance |
| **AI Office** | EU | EU AI Act | [TBD] | AI system compliance, market surveillance |
| [ADD AUTHORITY] | [JURISDICTION] | [AREA] | [CONTACT] | [NOTES] |

## 4. Breach Notification Tracking

Track all data breach notifications separately for quick reference and deadline compliance.

| Incident ID | Discovery Date | Authority Notified | Notification Date | Within 72h? | Individuals Notified | Individuals Notification Date | Case Ref | Status |
|-------------|---------------|--------------------|-------------------|-------------|----------------------|-------------------------------|----------|--------|
| [INC-001] | [DATE] | [AUTHORITY] | [DATE] | [YES/NO] | [YES/NO/NA] | [DATE/NA] | [REF#] | [STATUS] |

## 5. Audit and Inspection Log

| Audit Date | Authority | Type | Scope | Findings | Remediation Deadline | Remediation Status | Closed Date |
|------------|-----------|------|-------|----------|----------------------|--------------------|-------------|
| [DATE] | [AUTHORITY] | On-site/Remote/Document | [SCOPE] | [SUMMARY] | [DATE] | [STATUS] | [DATE] |

## 6. Open Follow-Up Actions

| # | Related Correspondence | Action Required | Owner | Deadline | Priority | Status |
|---|----------------------|-----------------|-------|----------|----------|--------|
| 1 | [CORRESPONDENCE #] | [ACTION DESCRIPTION] | [NAME] | [DATE] | High/Medium/Low | Open/In Progress/Closed |
| 2 | [CORRESPONDENCE #] | [ACTION DESCRIPTION] | [NAME] | [DATE] | High/Medium/Low | Open/In Progress/Closed |

## 7. Escalation Procedures

### 7.1 Inbound Communication

1. **Receipt:** All inbound regulatory communications must be forwarded to the DPO within 4 hours
2. **Logging:** DPO logs the communication in Section 1 within 24 hours
3. **Triage:** DPO assesses urgency and assigns priority
4. **Escalation:** High-priority matters escalated to Legal Counsel and Executive Sponsor within 24 hours
5. **Response:** Draft response within the regulatory deadline (default: 30 days unless otherwise specified)
6. **Review:** Legal Counsel reviews all outbound responses before sending
7. **Follow-up:** DPO tracks any required follow-up actions in Section 6

### 7.2 Proactive Notifications

1. **Assessment:** DPO determines notification obligation (breach, DPIA consultation, etc.)
2. **Drafting:** DPO prepares notification using approved templates
3. **Approval:** Legal Counsel and Executive Sponsor approve
4. **Submission:** DPO submits via authority's official channel
5. **Logging:** Record in Sections 1 and 4 (if breach-related)

## 8. Annual Summary

Complete at year-end for the Annual Review Checklist and board reporting.

| Metric | Count |
|--------|-------|
| Total regulatory communications | [N] |
| Inbound inquiries/complaints | [N] |
| Breach notifications filed | [N] |
| Audits/inspections completed | [N] |
| Open follow-up actions | [N] |
| Average response time (days) | [N] |
| Escalations to executive team | [N] |

## 9. Contact

| Role | Name | Email |
|------|------|-------|
| Data Protection Officer | Jane Mueller | dpo@acme-saas.com |
| General Inquiries | — | legal@acme.com |
| Legal Counsel | [NAME] | [EMAIL] |
| Executive Sponsor | [NAME] | [EMAIL] |

---

*This Regulatory Correspondence Log was generated by [Codepliant](https://github.com/joechensmartz/codepliant) based on an automated scan of the **nextjs-saas-example** codebase. This template should be reviewed and customized by your legal and compliance teams.*