Data catalog for GDPR and EU data sovereignty

Yes, a catalog can produce a draft record for each processing activity, but the controller and the DPO decide whether the record is complete and correct. The draft draws on ownership, classification tags, lineage and system inventory that the catalog holds. DeployOpen configures the catalog fields and export so that each dataset links to a named owner, a purpose, the categories of personal data and the storage location. Still to confirm: the purposes, legal bases, recipients, retention periods and the description of security measures, which come from the business owners and legal function, not from metadata alone. Treat the output as a working draft, not a finished register.

Each automated classification carries a confidence level, a source (such as a column name rule or sample-based recognition), and a review status that records who accepted or rejected it. This makes the inventory auditable rather than a single list of tags. DeployOpen can set up the review workflow and retain the decisions in the catalog. Still to confirm: the confidence threshold chosen for each source system, how false positives and false negatives were sampled and tested, and which steward signs off on sensitive categories. The DPO should see both automated and manually confirmed results.

A transfer register records where personal data is stored, which systems or support teams can view it, and which destinations receive it, including third countries. The catalog can hold these as attributes on data stores and pipelines, so the register updates when a pipeline or hosting location changes. Under EDPB Guidelines 05/2021, remote access from a third country, even display-only support access, counts as a transfer, so access paths must be captured, not just storage. Still to confirm: support vendor locations, sub-processor access, and the transfer tool relied on for each destination, which the legal team must assess.

Lineage shows how a dataset moves from source systems through pipelines into warehouses, dashboards and extracts, so copies and exports become visible. OpenMetadata supports table, column, dashboard and pipeline lineage with OpenLineage event integration, which lets the catalog show where a personal data field was copied. DeployOpen configures connectors and pipeline lineage capture for the in-scope systems. Still to confirm: that every pipeline emits lineage, that manual exports (spreadsheets, email attachments, file shares) are covered by process rather than by the catalog, and that gaps are documented as known limits.

The catalog records the owner, steward, review dates and changes to classifications, glossary terms and descriptions, which together show who was accountable for a dataset at a given time. This supports the accountability principle in Article 5(2) of the GDPR by making responsibility visible. DeployOpen sets the ownership model and review cadence during rollout. Still to confirm: that owners are real people with defined duties, that reviews happen on a schedule the DPO accepts, and that the history is retained for as long as the organization needs it for its own records.

The catalog can log who viewed, searched, edited or exported metadata, and those logs can show who looked at records of personal data. Whether these logs are complete depends on the platform version, the authentication setup and where logs are shipped. DeployOpen configures SSO, role-based access and log export to the organization's own storage. Still to confirm: which events are logged in the chosen version, how long logs are retained, who can read them, and whether they meet the organization's internal and regulatory retention rules. Consult the OpenMetadata security documentation for the current logging model.

No. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. The DPO, the controller's legal team and, where applicable, independent auditors or supervisory authorities make the determinations about compliance. The catalog outputs are inputs to those decisions. Engagements are fixed-scope, with scope and deliverables agreed in writing before work starts, so the boundary of what is prepared is clear from the outset.

The Court of Justice in Case C-311/18 invalidated the Privacy Shield but held that standard contractual clauses remained valid, so transfer evidence must show the transfer tool and any supplementary measures in use. The catalog can record which systems rely on which tool, but it cannot decide whether a destination offers adequate protection. Under EDPB Recommendations 01/2020, where a provider needs access in the clear and third-country powers go beyond what is necessary and proportionate, the EDPB cannot envision an effective technical supplementary measure. Ask the legal team to assess each such exposure.

The software is not the main line item: OpenMetadata and DataHub are both licensed under Apache-2.0, so the cost is the infrastructure they run on, the setup work and the people who maintain the metadata. One-time costs include deployment, connector configuration, lineage setup and the first pass of personal data classification. Recurring costs include the database and search services, compute and storage, upgrades (OpenMetadata 2.0 introduced breaking changes that require planning), and ongoing stewardship time from data owners and the DPO's office. Ask any quote to separate these categories so you can see which items recur every year.

OpenMetadata's bare metal documentation lists Java 21, MySQL 8.0.42 or later or PostgreSQL 15 or later, and Elasticsearch 9.x or OpenSearch 3.x. The documented minimum server sizing is 2 vCPUs, 4 GB RAM and 20 GB storage, with the database and search services each needing at least 2 vCPUs, 2 GB RAM and 30 GB storage. These are minimums for a trial or small estate, not production sizing. Production capacity depends on how many sources you ingest, how often you profile, and how much history you keep, so ask for a sizing estimate tied to your source count before approving hardware.

The biggest drivers are the number of source systems, the amount of free-text data, and the number of jurisdictions involved. Each additional source needs a connector, an owner and a review of its columns for personal data. Free-text fields, such as notes, tickets and documents, rarely follow column name rules, so they need sample-based review and more manual checking. Each jurisdiction adds transfer questions: where data is stored, who can access it remotely, and whether a processor is subject to third-country law. Estates with many legacy systems and few documented owners usually take the longest to map.

The DPO's office defines the personal data categories, the records of processing content and the transfer assessments the catalog must support. System owners confirm what each dataset holds, who uses it and where copies are kept, because a catalog cannot reliably infer purpose or legal basis. IT provides service accounts with read access to each source, network paths from the catalog to the sources, SSO configuration, and a place to host the platform inside your EU-controlled environment. Plan these inputs before the project starts, since access requests are often the longest wait in the early phase.

A capable platform team can deploy OpenMetadata or DataHub alone, especially if it has Kubernetes or database operations experience and a clear owner for metadata. The harder part is usually the non-technical work: agreeing classifications with legal, maintaining ownership for every dataset, and keeping lineage and transfer records current after systems change. Ask whether your team has capacity for the first mapping pass and for ongoing upgrades, since OpenMetadata releases arrive every one to two weeks as maintenance versions. A partner can help with the setup and handover, while the stewardship model stays with your staff.

DeployOpen's quotes follow from a written scope, and most engagements are fixed-scope with deliverables and timelines agreed before work starts. Ask the quote to list the sources and connectors in scope, the hosting model and environments, how lineage will be captured, how personal data classification is tuned and reviewed, the records of processing fields that will be populated, the handover and documentation, and what ongoing support or upgrades are excluded. Ask also what the client must provide and by when, because delays on the client side are the most common reason a fixed timeline moves.

No. A catalog records and evidences your processing, but it does not make it lawful or issue any audit report or certification. Independent auditors and certification bodies assess the controls, and the DPO and legal team decide the legal basis and transfer mechanisms. The catalog's value is that it keeps the inventory, ownership, lineage and transfer locations current enough to support those reviews. Confirm with your legal counsel which records and assessments they need the catalog to produce before you define its fields.