Skip to Content

GDPR Compliance Suite for Odoo 19

by
Odoo

$ 287.35

v 19.0 Third Party
Live Preview
Availability
Odoo Online
Odoo.sh
On Premise
Odoo Apps Dependencies Discuss (mail)
Lines of code 4417
Technical Name flexigo_gdpr_toolkit
LicenseOPL-1
Websitehttps://flexigotech.com
You bought this module and need support? Click here!
Availability
Odoo Online
Odoo.sh
On Premise
Odoo Apps Dependencies Discuss (mail)
Lines of code 4417
Technical Name flexigo_gdpr_toolkit
LicenseOPL-1
Websitehttps://flexigotech.com
EUR 249 · OPL‑1 · ODOO 19

GDPR compliance, native in Odoo 19

RoPA Art.30 · DSAR Arts.15–21 · Breach Log Arts.33–34 · DPIA Art.35 · Retention Management. All inside your Odoo instance — no external SaaS, no monthly subscription.

Talk to a GDPR expert One‑time licence. Install from the button at the top of this page.
GDPR Compliance Suite for Odoo 19: four-pillar dashboard with encrypted breach log and DPIA workflow
RoPA — Art.30
Records of Processing
DSAR — Arts.15‑21
Six request types
Breach — 72h
Art.33 countdown
DPIA — Art.35
WP248 methodology

The compliance tax you pay every month

GDPR has been in force since 2018, yet most EU businesses still manage their operational obligations in spreadsheets — or pay €500–€1,500 per month for external SaaS platforms like OneTrust and TrustArc. That is a permanent tax on staying compliant.

€500/mo × 12 months = €6,000/year. Every year. Forever.

No central RoPA

Processing activities scattered across department spreadsheets, never audit‑ready.

DSAR by email

Requests arrive with no workflow and no tracking of the 30‑day deadline.

Breach on paper

No 72‑hour countdown enforcement for the Art.33 DPA notification window.

Ad‑hoc DPIA

Impact assessments done without structured methodology or an approval gate.

How GDPR Compliance Suite solves it

Four core GDPR operational modules, natively inside Odoo 19. Your data stays in your instance. No third‑party API calls. No per‑user licence. One price, forever.

RoPA — Records of Processing (Art.30)

Mandatory register for controllers and processors. Immutable version history on every save. DPIA criteria scoring with the WP248 nine‑criteria rule. Export to PDF or multi‑sheet Excel. Activation gate requires a linked DPIA approval.

DSAR — Data Subject Rights (Arts.15‑21)

All six request types: access, erasure, portability, objection, restriction, rectification. Automatic 30‑day deadline clock per Art.12(3). Extension workflow with notification tracking. Public portal with anti‑abuse controls and anonymous status tracking.

Breach Log — Personal Data Breach (Arts.33‑34)

72‑hour live countdown for DPA notification per Art.33(1). EDPB 9/2022 risk matrix combining impact and likelihood. Automatic Art.34 data‑subject notification flag. Immutable records with an archive‑requires‑reason policy.

DPIA — Impact Assessment (Art.35)

WP248 rev.01 five‑step methodology: description, necessity and proportionality, risk identification, mitigation, residual risk. Prior consultation flag per Art.36. Approval workflow with locked post‑approval records. PDF report generation.

Retention — Storage Limitation (Art.5(1)(e))

Define retention periods per data category with automated daily cron alerts. Review actions: retained, anonymised, deleted, or extended with mandatory justification. Conflict‑detection wizard checks invoices, HR and sales data before deletion.

Compliance Dashboard

Single‑screen DPO overview: open DSARs, overdue deadlines, active breaches, pending DPIAs, expiring retention records. Real‑time KPI cards on every page load — the dashboard a DPA inspector wants to see on day one.

See it in action

English walkthrough
Español
Deutsch

Feature walkthrough

Odoo 19 home screen showing GDPR Compliance menu entry with all four pillars accessible from the top navigation
1 · Odoo Home — The suite installs as a top‑level Odoo 19 application. All four pillars (RoPA, DSAR, Breach Log, DPIA) plus Retention, Dashboard and Configuration are one click from the main navigation bar.
GDPR compliance dashboard with real-time KPI cards showing open DSARs, active breaches, pending DPIAs and expiring retention records
2 · Compliance Dashboard — The DPO single‑screen overview: open DSARs with overdue count, active breaches under assessment, pending DPIAs and retention records expiring within 30 days. The dashboard a DPA inspector expects on day one of an audit.
Records of Processing Activities list view showing multiple activities with legal basis, data categories, and DPIA-required status badges
3 · RoPA Register (Art.30) — The mandatory Article 30 register: each processing activity shows name, legal basis, data categories and state. A warning badge flags activities that meet DPIA criteria and require an assessment before activation.
RoPA processing activity detail form showing Marketing Prospect Profiling activity with DPIA required flag triggered by profiling and large-scale criteria
4 · RoPA Detail with DPIA Trigger — Marketing Prospect Profiling meets two WP248 criteria (profiling and large‑scale processing), so Odoo automatically sets the DPIA‑required flag and blocks activation until an approved DPIA is attached.
Data Subject Rights request queue showing cards for access, erasure, portability, objection, restriction, and rectification requests with deadline indicators
5 · DSAR Request Queue (Arts.15‑21) — The DPO unified inbox for incoming data‑subject requests. Each card shows request type, subject name, receipt date and days remaining before the 30‑day deadline expires per Article 12(3).
DSAR record detail form showing access request with automatic 30-day deadline calculation from receipt date and processing stage tracking
6 · DSAR Detail with Deadline Clock — The deadline calculates automatically from the receipt date: an access request received on 26 May 2026 is due 26 June 2026, exactly one calendar month per Article 12(3). Overdue records turn red and notify the DPO.
Personal Data Breach Log list showing multiple breaches with discovery dates, types, severity states, and 72-hour DPA notification window indicators
7 · Breach Log Register (Art.33) — Every breach event is captured in a centralised, immutable register. The list shows discovery date, breach type, current state and whether the 72‑hour DPA notification window is still open.
Breach detail form showing medium-severity breach with EDPB 9/2022 risk matrix, 72-hour countdown, and Art.34 data subject notification flag
8 · Breach Detail with Risk Matrix (Art.34) — The EDPB 9/2022 risk matrix combines impact and likelihood scores. When both reach 4/5 the system activates the Article 34 data‑subject notification flag, and the 72‑hour countdown is shown prominently.
Data Protection Impact Assessment list showing multiple DPIAs with processing activity, WP248 methodology, assigned DPO, and approval state
9 · DPIA Register (Art.35) — Tracks every impact assessment under Article 35. Each record shows the processing activity it covers, the WP248 five‑step methodology, the assigned DPO and the approval state. Approved DPIAs unblock their linked RoPA activity.
DPIA form walking through WP248 five-step methodology: description, necessity and proportionality, risk identification, mitigation measures, and residual risk
10 · DPIA Form (WP248 Methodology) — The full five‑step DPIA: description, necessity and proportionality, risk identification and mitigation. An Article 36 prior‑consultation flag appears when residual risk stays high. Once approved, the record locks against retroactive edits.
Retention schedule list showing data categories with maximum retention periods in months, legal basis, and expiry actions: anonymise or delete
11 · Retention Schedule (Art.5(1)(e)) — The storage‑limitation module enforces that personal data is not kept longer than necessary. Each row defines a data category, its maximum retention period, the legal basis and the expiry action: anonymise or delete.
Compliance audit log showing append-only entries with user, timestamp, model, record reference, and action taken across all GDPR modules
12 · Immutable Audit Log — Every state change, access event and export across all GDPR modules is captured in an append‑only log: user, timestamp, model, record and action. Records cannot be edited or deleted through the interface.
Portal privacy rights page showing data subject options to submit access, erasure, portability, or objection requests with secure token-based status tracking
13 · Data Subject Portal — The privacy‑rights portal at /my/privacy‑rights lets data subjects submit access, erasure, portability or objection requests directly. Every submission creates a full audit‑trail entry the moment the request lands.

Who needs this

Data Protection Officers

Your daily operational dashboard for every GDPR obligation in one place, with automatic deadline tracking and audit‑ready reporting.

Compliance teams at EU SMBs

Replace spreadsheets and shared drives with a structured, immutable compliance system that costs less than one month of OneTrust.

HR directors and legal counsel

Employee data processing, DSAR responses and retention schedules managed inside the same Odoo instance the company already uses daily.

Odoo partners and integrators

Deploy a complete GDPR stack for clients without external SaaS dependencies, Schrems II exposure or recurring subscription fees.

Companies under AEPD supervision

Spanish supervisory authority details and LOPDGDD 3/2018 references are built in, alongside the EU‑wide GDPR workflows.

Privacy‑first organisations

Keep all GDPR data inside an EU‑hosted Odoo instance — no third‑party processor, no cross‑border transfer to manage.

Compatibility

Odoo version19.0 Community and Enterprise
Multi‑companyStrict record rules isolate data per legal entity
Multi‑languageEnglish UI with translatable field labels
Python dependenciescryptography (Fernet encryption), openpyxl (Excel export)
Data residencyNo external API calls, no SaaS, no data leaving your instance
LicenceOPL‑1 (Odoo Proprietary Licence v1.0)
SupportFlexigoTech — comercial@flexigotech.com

Pricing

€249
per database · one‑time OPL‑1 licence
No subscription. No per‑user charge. Ever.

What is included

All four core modules (RoPA, DSAR, Breach Log, DPIA), Retention Management and the Compliance Dashboard. Audit log, DPO config, portal privacy rights, PDF reports and Excel export. Free updates for all 19.0.x releases.

Compare

OneTrust starts at €500/month (€6,000/year); TrustArc is comparable. The only equivalent Odoo 19 app covering our full scope lists at €319.99. GDPR Compliance Suite is a one‑time €249 — your data never leaves your Odoo instance and there is no vendor lock‑in.

This app supports your GDPR compliance workflows under Regulation (EU) 2016/679. It does not constitute legal advice. Consult your legal counsel for binding interpretation.

Frequently asked questions

Does this app make me 100% GDPR compliant?

No software can guarantee full legal compliance. What it does is give you the operational tooling Articles 30, 15‑21, 33‑34 and 35 require: a structured RoPA register, a DSAR workflow with deadline tracking, a breach log with 72‑hour countdown and a WP248 DPIA methodology. Consult your DPO or legal counsel for a complete assessment.

How is this different from Odoo’s built‑in privacy features?

Odoo 19 includes privacy_consent for cookie banners. It does not include a RoPA register, DSAR workflow, breach log, DPIA methodology, retention enforcement or a compliance dashboard. This suite fills those gaps with purpose‑built modules that integrate with Odoo’s security and portal frameworks.

Do I need an external SaaS subscription for this to work?

No. Everything runs inside your Odoo instance. No data is sent to external servers and no third‑party API keys are required. This matters for Schrems II: if your Odoo instance is hosted in the EU, your GDPR data stays in the EU. The optional Fernet encryption key is a server‑level environment variable you control.

What happens when a DSAR deadline is missed?

When the 30‑day deadline passes without the request being closed, the DSAR record turns red and an overdue notification is sent to the assigned DPO. You can grant a 30‑day extension under Art.12(3) with mandatory notification to the data subject, which resets the deadline clock.

Can this handle multiple companies in one database?

Yes. Strict Odoo record rules segregate GDPR data per company. A DPO for Company A cannot see the RoPA records, DSAR requests or breach logs of Company B. Each legal entity can have its own DPO configuration, enforced at the database level rather than the UI.

Is there Spanish (AEPD / LOPDGDD) support?

The module includes Spanish supervisory authority (AEPD) details and LOPDGDD 3/2018 references, and field labels are ready for translation. The workflows follow the EU‑wide GDPR. For AEPD‑specific report templates beyond what is included, contact FlexigoTech for a customisation quote.

What about encryption? Is my breach data secure?

Sensitive fields in the DSAR and Breach Log modules support Fernet symmetric encryption at rest. Set the GDPR_FERNET_KEY environment variable on your Odoo server and those fields are encrypted before writing to the database. The audit log is append‑only: create is allowed; write and delete raise AccessError.

Ready to bring GDPR inside your Odoo?

Install GDPR Compliance Suite today from the Odoo Apps Store, or talk to our team about a deployment.

Contact comercial@flexigotech.com

FlexigoTech · Built for Odoo 19 partners · flexigotech.com

Odoo Proprietary License v1.0

This software and associated files (the "Software") may only be used (executed,
modified, executed after modifications) if you have purchased a valid license
from the authors, typically via Odoo Apps, or if you have received a written
agreement from the authors of the Software (see the COPYRIGHT file).

You may develop Odoo modules that use the Software as a library (typically
by depending on it, importing it and using its resources), but without copying
any source code or material from the Software. You may distribute those
modules under the license of your choice, provided that this license is
compatible with the terms of the Odoo Proprietary License (For example:
LGPL, MIT, or proprietary licenses similar to this one).

It is forbidden to publish, distribute, sublicense, or sell copies of the Software
or modified copies of the Software.

The above copyright notice and this permission notice must be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.

Please log in to comment on this module

  • The author can leave a single reply to each comment.
  • This section is meant to ask simple questions or leave a rating. Every report of a problem experienced while using the module should be addressed to the author directly (refer to the following point).
  • If you want to start a discussion with the author or have a question related to your purchase, please use the support page.