IGDTA compliance settings

IGDTA Compliance Settings

The IGDTA Configuration screen is where you set up and maintain your organisation's Intra-Group Data Transfer Agreement — the formal legal instrument that allows companies within the same corporate group to share personal data lawfully across borders and jurisdictions. If your organisation spans multiple legal entities (a parent company and its subsidiaries, for example), this screen is the single place in DPMS where you define who administers the agreement, which group companies are bound by it, and what notice period applies before anyone can exit it. Until this screen is configured, DPMS has no way of knowing the structure of your IGDTA, and the left-hand navigation will display an "incomplete" indicator as a reminder.

How to open it

Navigate to this screen from anywhere in the Compliance Settings area:

• Open the left sidebar of the DPMS application.
• Click General Settings in the sidebar heading to expand the compliance settings sub-navigation.
• Scroll down and click IGDTA Configuration in the sub-menu.

Who can see it: You need the view permission for IGDTA Configuration to access this screen at all. Without it, you will see a "403 – Forbidden" page and the menu item will not appear in the sidebar. To make changes, you also need the edit permission — and, once the agreement has been configured for the first time, you must belong to the company that has been designated as the Group Representative.

What you see

The screen is divided into two columns. The narrow left column contains the General Settings sub-navigation menu, with IGDTA Configuration highlighted as the active item. A small "incomplete" badge appears next to the menu item until the configuration has been saved for the first time — this is a visual cue visible to any user who has access, not just administrators.

The wider right column shows the IGDTA Configuration card. At the top of the card sits a breadcrumb trail (General Settings › IGDTA Configuration) that lets you navigate quickly back to the top-level settings area or step to adjacent settings pages using the arrow controls. Below the breadcrumb, the main card displays four labelled fields stacked vertically:

• Group Representative — the company that administers the agreement
• IGDTA Eligible — the list of companies that are parties to the agreement
• Group Representative Administrator — the named individuals authorised to manage this configuration
• Termination Notice Period — how many calendar days' notice is required to exit the agreement

If the configuration has never been saved, all four fields appear blank. A small pencil icon in the top-right corner of the card opens the edit form — but only if the business rules allow it (see below).

Working with this screen

Setting up your IGDTA for the first time

When you arrive here and all four fields are blank, DPMS treats the agreement as unconfigured. As long as no Group Representative has been saved yet, the pencil icon is visible to any user who holds the edit permission, so you can proceed directly.

Click the pencil icon in the top-right corner of the card. You are taken to the edit form, which contains everything you need to capture the full IGDTA structure.

Step 1 — Designate your company as Group Representative. At the top of the form you will see a rectangular button labelled Set as Group Representative. Click it. The button turns black with white text, confirming that your company is now designated as the entity that administers the agreement. This action also reveals the Group Representative Administrator multi-select field immediately below.

Step 2 — Name the administrators. In the Group Representative Administrator picker, select the individuals within your company who will have operational authority over this configuration going forward. You can select yourself, a colleague, or both. These are the people who will be able to edit the configuration after the first save — so choose carefully. If you leave the field untouched, DPMS will pre-populate it with your own account.

Step 3 — Mark eligible companies. Below the administrator section, you will see a list of all companies in the system. Each row has a toggle switch labelled IGDTA Eligible and the company's name. Flip the toggle to blue for every subsidiary or group entity that is a party to the agreement. Companies whose toggles are left grey are not considered parties and will not appear in the read view's eligible list.

Step 4 — Set the termination notice period. Find the Termination Notice Period field near the bottom of the form. It defaults to 30 days. If your signed legal document specifies a different period — 60 days, 90 days, or any other number — type that number here. The label days to the right of the input is fixed; just enter a whole number of at least 1.

Step 5 — Save. Click the Save button at the bottom of the form. DPMS sends the configuration to the server and, on a successful save, updates the system so that:

• The "incomplete" badge next to IGDTA Configuration in the sidebar disappears.
• The read view now shows all four populated fields.
• Any user from a different company who visits the screen will no longer see the edit button — control now rests exclusively with the Group Representative.

To return to the read view, click the × button (back/close) at the top of the edit form. You will see your saved values displayed in the card.

Updating the eligible companies list after a group restructuring

Six months after the initial setup, a new subsidiary joins the group or an existing entity leaves. The DPO at the Group Representative company needs to update the list.

Navigate to General Settings › IGDTA Configuration. Because your company is the Group Representative, the pencil icon is visible. Click it to open the edit form.

In the IGDTA Eligible section, find the row for the newly joined subsidiary and flip its toggle from grey to blue. If a company has left the group, find its row and flip the toggle back to grey. You do not need to touch any other field. Click Save. The updated list is immediately reflected on the read view.

Heads up: The list of companies is loaded fresh from the server each time you open the edit form. If a brand-new company was just added to the DPMS instance in another browser tab or session, you may need to reload the edit page to see it appear in the toggle list.

Updating the administrator list after a staff change

A compliance officer who was listed as a Group Representative Administrator leaves the organisation. Their replacement needs to be added, and the departing person needs to be removed.

A remaining administrator navigates to General Settings › IGDTA Configuration and clicks the pencil icon. In the Group Representative Administrator multi-select, they click the remove control next to the departing officer's name, then use the search field in the picker to find and select the new administrator. They click Save. From that point on, only the updated list of administrators will have edit access to this screen.

Reviewing the configuration for an audit

A compliance reviewer or external auditor who has been granted read-only access navigates to General Settings › IGDTA Configuration. They can see all four fields — Group Representative, eligible companies, administrators, and termination notice period — displayed in the read view. No edit button is visible because they do not hold edit permissions. They copy the relevant values into their audit report or take a screenshot. No changes can be made from a read-only account.

Field reference

• Set as Group Representative / Revoke Group Representative button — Toggles whether your company is the administering entity. Black button = your company is the representative; white button = it is not. This must be set to "representative" before the Administrator field appears. Clicking does not save automatically — you must click Save to persist the change.
• IGDTA Eligible (toggle per company) — One toggle per company in the system. Blue = that company is a party to the agreement; grey = it is not. At least one company should be toggled on for the agreement to be meaningful.
• Group Representative Administrator — A multi-select people picker. Only visible when your company is set as Group Representative. Select one or more users who will manage this configuration. If left at the default, DPMS pre-fills it with your own account. Required if you are designating your company as the representative.
• Termination Notice Period — A number field (whole numbers only, minimum 1). Enter the number of calendar days' notice required to terminate the agreement, as specified in your signed legal document. Defaults to 30 if no value was previously saved. A value of 0 or below will silently block saving — no error message is displayed, so make sure the field contains at least 1.

How this connects to the rest of DPMS

This screen sits inside the Compliance Settings module, alongside General, Applicable Laws, Attributes, Status, Departments, Organisational Units, Standards, Control Sets, Risk Scenarios, Maturity Model, Deadlines and Urgency, and Questionnaires. You can step between these settings pages using the navigation arrows in the breadcrumb bar without returning to a list.

What you configure here has two immediate effects across the entire application:

• The "incomplete" badge on the menu item. Until this screen is saved for the first time, every user who has access to the sidebar will see an incomplete indicator next to IGDTA Configuration. A successful save removes the badge for the entire session.
• Edit access for other companies' users. Once a Group Representative is saved, DPMS updates the stored IGDTA company information used throughout the session. From that moment, any user from a company that is not the Group Representative will no longer see the pencil icon on this screen — even if they hold the edit permission. This means a save here can immediately and silently change what another company's DPO sees when they visit the screen.

After finishing here, consider reviewing the adjacent Compliance Settings pages — particularly Organisational Units and Applicable Laws — to ensure your broader compliance setup reflects the group structure you have just defined.

Tips & common pitfalls

Tip: Before clicking Save for the very first time, double-check the Termination Notice Period field. The default is 30 days, and if your signed agreement specifies a different period, you must update it manually — DPMS does not read this value from any other source.

Heads up: Clicking Set as Group Representative does not save anything. It only changes the local form state. If you navigate away or click the × button without saving, your company's representative status will not be updated in the database.

• The edit button disappears after the first save. Once the Group Representative is recorded, only users from that company will see the pencil icon. Users from subsidiary companies who hold the edit permission will still reach the read view, but they cannot make changes. This is by design — if you receive a report that someone "can't edit the IGDTA," check which company they belong to before escalating it as a technical issue.
• A value of zero in the Termination Notice Period silently blocks saving. If a user clears the field or types 0, clicking Save does nothing — no error message appears. Ensure the field always contains a positive whole number.
• Only one company can be the Group Representative at a time. If a second company's administrator opens the edit form and clicks Set as Group Representative, they will overwrite the existing representative when they save. There is no warning or conflict dialog. Coordinate with your group before making this change.
• The administrator list controls future edit access. If you accidentally remove all administrators — including yourself — from the Group Representative Administrator picker and save, no one from the Group Representative company will be able to open the edit form. Plan administrator changes carefully, and always keep at least one active user in the list.
• The incomplete badge persists until the first successful save. If the save fails due to a network error or server-side validation issue, the badge remains even after you have filled in all the fields. Try saving again once the issue is resolved.