> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Organization: Acme Inc

Project: nextjs-saas-example

Last updated: 2026-03-19

Maintained by: Jane Mueller (dpo@acme-saas.com)

This document tracks all communications with regulatory authorities, including inquiries, complaints, audits, notifications, and follow-up actions. Maintaining a complete correspondence log is a GDPR accountability requirement (Art. 5(2)) and demonstrates good-faith compliance to supervisory authorities.

> Retention: Keep all correspondence records for a minimum of 6 years from the date of last communication. Store securely with restricted access.

## 1. Correspondence Register

Record every inbound and outbound communication with any regulatory authority.

# | Date | Direction | Authority | Contact Person | Topic | Reference No. | Outcome | Follow-Up Required | Follow-Up Deadline | Status
--- | --- | --- | --- | --- | --- | --- | --- | --- | --- | ---
1 | [DATE] | Inbound/Outbound | [AUTHORITY NAME] | [NAME/DEPT] | [BRIEF TOPIC] | [REF#] | [OUTCOME SUMMARY] | [YES/NO] | [DATE] | Open/Closed
2 | [DATE] | Inbound/Outbound | [AUTHORITY NAME] | [NAME/DEPT] | [BRIEF TOPIC] | [REF#] | [OUTCOME SUMMARY] | [YES/NO] | [DATE] | Open/Closed
3 | [DATE] | Inbound/Outbound | [AUTHORITY NAME] | [NAME/DEPT] | [BRIEF TOPIC] | [REF#] | [OUTCOME SUMMARY] | [YES/NO] | [DATE] | Open/Closed

## 2. Communication Categories

Category | Description | Typical Deadline
--- | --- | ---
Data Breach Notification | Mandatory notification under GDPR Art. 33 / state breach laws | 72 hours (GDPR), varies by state
DSAR Escalation | Regulator inquiry following unresolved data subject request | 30 days from regulator inquiry
Complaint Investigation | Formal investigation following a data subject complaint | Per authority timeline
Audit / Inspection | Planned or unplanned regulatory audit | Per audit schedule
Proactive Consultation | DPIA consultation (GDPR Art. 36) or voluntary disclosure | 8 weeks (GDPR Art. 36(2))
Annual Filing | Required annual reports or registrations | Per jurisdiction
Cross-Border Transfer | Transfer mechanism notifications or approvals | Per mechanism
AI Incident Report | EU AI Act mandatory serious incident reports | 15 days (EU AI Act Art. 62)

## 3. Relevant Regulatory Authorities

Authorities relevant to this project based on detected jurisdictions and services:

Authority | Jurisdiction | Area | Contact | Notes
--- | --- | --- | --- | ---
PCI SSC | International | Payment card data | pcisecuritystandards.org | PCI DSS compliance
AI Office | EU | EU AI Act | [TBD] | AI system compliance, market surveillance
[ADD AUTHORITY] | [JURISDICTION] | [AREA] | [CONTACT] | [NOTES]

## 4. Breach Notification Tracking

Track all data breach notifications separately for quick reference and deadline compliance.

Incident ID | Discovery Date | Authority Notified | Notification Date | Within 72h? | Individuals Notified | Individuals Notification Date | Case Ref | Status
--- | --- | --- | --- | --- | --- | --- | --- | ---
[INC-001] | [DATE] | [AUTHORITY] | [DATE] | [YES/NO] | [YES/NO/NA] | [DATE/NA] | [REF#] | [STATUS]

## 5. Audit and Inspection Log

Audit Date | Authority | Type | Scope | Findings | Remediation Deadline | Remediation Status | Closed Date
--- | --- | --- | --- | --- | --- | --- | ---
[DATE] | [AUTHORITY] | On-site/Remote/Document | [SCOPE] | [SUMMARY] | [DATE] | [STATUS] | [DATE]

## 6. Open Follow-Up Actions

# | Related Correspondence | Action Required | Owner | Deadline | Priority | Status
--- | --- | --- | --- | --- | --- | ---
1 | [CORRESPONDENCE #] | [ACTION DESCRIPTION] | [NAME] | [DATE] | High/Medium/Low | Open/In Progress/Closed
2 | [CORRESPONDENCE #] | [ACTION DESCRIPTION] | [NAME] | [DATE] | High/Medium/Low | Open/In Progress/Closed

## 7. Escalation Procedures

### 7.1 Inbound Communication

1. Receipt: All inbound regulatory communications must be forwarded to the DPO within 4 hours
2. Logging: DPO logs the communication in Section 1 within 24 hours
3. Triage: DPO assesses urgency and assigns priority
4. Escalation: High-priority matters escalated to Legal Counsel and Executive Sponsor within 24 hours
5. Response: Draft response within the regulatory deadline (default: 30 days unless otherwise specified)
6. Review: Legal Counsel reviews all outbound responses before sending
7. Follow-up: DPO tracks any required follow-up actions in Section 6

### 7.2 Proactive Notifications

1. Assessment: DPO determines notification obligation (breach, DPIA consultation, etc.)
2. Drafting: DPO prepares notification using approved templates
3. Approval: Legal Counsel and Executive Sponsor approve
4. Submission: DPO submits via authority's official channel
5. Logging: Record in Sections 1 and 4 (if breach-related)

## 8. Annual Summary

Complete at year-end for the Annual Review Checklist and board reporting.

Metric | Count
--- | ---
Total regulatory communications | [N]
Inbound inquiries/complaints | [N]
Breach notifications filed | [N]
Audits/inspections completed | [N]
Open follow-up actions | [N]
Average response time (days) | [N]
Escalations to executive team | [N]

## 9. Contact

Role | Name | Email
--- | --- | ---
Data Protection Officer | Jane Mueller | dpo@acme-saas.com
General Inquiries | — | legal@acme.com
Legal Counsel | [NAME] | [EMAIL]
Executive Sponsor | [NAME] | [EMAIL]

This Regulatory Correspondence Log was generated by Codepliant based on an automated scan of the nextjs-saas-example codebase. This template should be reviewed and customized by your legal and compliance teams.