Add processing activity registries

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2025-08-27 16:18:18 +02:00
parent bb68af1d3c
commit 199de3bdb0
32 changed files with 9702 additions and 306 deletions
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -48,4 +48,5 @@ const (
 	VendorServiceEntityType
 	SnapshotEntityType
 	ContinualImprovementRegistryEntityType
+	ProcessingActivityRegistryEntityType
 )
--- a/pkg/coredata/migrations/20250827T125533Z.sql
+++ b/pkg/coredata/migrations/20250827T125533Z.sql
@@ -0,0 +1,69 @@
+CREATE TYPE processing_activity_registries_special_or_criminal_data AS ENUM (
+    'YES',
+    'NO',
+    'POSSIBLE'
+);
+
+CREATE TYPE processing_activity_registries_lawful_basis AS ENUM (
+    'LEGITIMATE_INTEREST',
+    'CONSENT',
+    'CONTRACTUAL_NECESSITY',
+    'LEGAL_OBLIGATION',
+    'VITAL_INTERESTS',
+    'PUBLIC_TASK'
+);
+
+CREATE TYPE processing_activity_registries_transfer_safeguards AS ENUM (
+    'STANDARD_CONTRACTUAL_CLAUSES',
+    'BINDING_CORPORATE_RULES',
+    'ADEQUACY_DECISION',
+    'DEROGATIONS',
+    'CODES_OF_CONDUCT',
+    'CERTIFICATION_MECHANISMS'
+);
+
+CREATE TYPE processing_activity_registries_data_protection_impact_assessment AS ENUM (
+    'NEEDED',
+    'NOT_NEEDED'
+);
+
+CREATE TYPE processing_activity_registries_transfer_impact_assessment AS ENUM (
+    'NEEDED',
+    'NOT_NEEDED'
+);
+
+CREATE TABLE processing_activity_registries (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL,
+    audit_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    purpose TEXT,
+    data_subject_category TEXT,
+    personal_data_category TEXT,
+    special_or_criminal_data processing_activity_registries_special_or_criminal_data NOT NULL,
+    consent_evidence_link TEXT,
+    lawful_basis processing_activity_registries_lawful_basis NOT NULL,
+    recipients TEXT,
+    location TEXT,
+    international_transfers BOOLEAN NOT NULL,
+    transfer_safeguards processing_activity_registries_transfer_safeguards,
+    retention_period TEXT,
+    security_measures TEXT,
+    data_protection_impact_assessment processing_activity_registries_data_protection_impact_assessment NOT NULL,
+    transfer_impact_assessment processing_activity_registries_transfer_impact_assessment NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+
+    CONSTRAINT processing_activity_registries_organization_id_fkey
+        FOREIGN KEY (organization_id)
+        REFERENCES organizations(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE,
+
+    CONSTRAINT processing_activity_registries_audit_id_fkey
+        FOREIGN KEY (audit_id)
+        REFERENCES audits(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE
+);
--- a/pkg/coredata/processing_activity_registries.go
+++ b/pkg/coredata/processing_activity_registries.go
@@ -0,0 +1,473 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	ProcessingActivityRegistry struct {
+		ID                             gid.GID                                                  `db:"id"`
+		OrganizationID                 gid.GID                                                  `db:"organization_id"`
+		AuditID                        gid.GID                                                  `db:"audit_id"`
+		Name                           string                                                   `db:"name"`
+		Purpose                        *string                                                  `db:"purpose"`
+		DataSubjectCategory            *string                                                  `db:"data_subject_category"`
+		PersonalDataCategory           *string                                                  `db:"personal_data_category"`
+		SpecialOrCriminalData          ProcessingActivityRegistrySpecialOrCriminalData          `db:"special_or_criminal_data"`
+		ConsentEvidenceLink            *string                                                  `db:"consent_evidence_link"`
+		LawfulBasis                    ProcessingActivityRegistryLawfulBasis                    `db:"lawful_basis"`
+		Recipients                     *string                                                  `db:"recipients"`
+		Location                       *string                                                  `db:"location"`
+		InternationalTransfers         bool                                                     `db:"international_transfers"`
+		TransferSafeguards             *ProcessingActivityRegistryTransferSafeguards            `db:"transfer_safeguards"`
+		RetentionPeriod                *string                                                  `db:"retention_period"`
+		SecurityMeasures               *string                                                  `db:"security_measures"`
+		DataProtectionImpactAssessment ProcessingActivityRegistryDataProtectionImpactAssessment `db:"data_protection_impact_assessment"`
+		TransferImpactAssessment       ProcessingActivityRegistryTransferImpactAssessment       `db:"transfer_impact_assessment"`
+		CreatedAt                      time.Time                                                `db:"created_at"`
+		UpdatedAt                      time.Time                                                `db:"updated_at"`
+	}
+
+	ProcessingActivityRegistries []*ProcessingActivityRegistry
+)
+
+func (p *ProcessingActivityRegistry) CursorKey(field ProcessingActivityRegistryOrderField) page.CursorKey {
+	switch field {
+	case ProcessingActivityRegistryOrderFieldCreatedAt:
+		return page.NewCursorKey(p.ID, p.CreatedAt)
+	case ProcessingActivityRegistryOrderFieldName:
+		return page.NewCursorKey(p.ID, p.Name)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", field))
+}
+
+func (p *ProcessingActivityRegistry) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	processingActivityRegistryID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	audit_id,
+	name,
+	purpose,
+	data_subject_category,
+	personal_data_category,
+	special_or_criminal_data,
+	consent_evidence_link,
+	lawful_basis,
+	recipients,
+	location,
+	international_transfers,
+	transfer_safeguards,
+	retention_period,
+	security_measures,
+	data_protection_impact_assessment,
+	transfer_impact_assessment,
+	created_at,
+	updated_at
+FROM
+	processing_activity_registries
+WHERE
+	%s
+	AND id = @processing_activity_registry_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"processing_activity_registry_id": processingActivityRegistryID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query processing activity registry: %w", err)
+	}
+
+	processingActivityRegistry, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ProcessingActivityRegistry])
+	if err != nil {
+		return fmt.Errorf("cannot collect processing activity registry: %w", err)
+	}
+
+	*p = processingActivityRegistry
+
+	return nil
+}
+
+func (p *ProcessingActivityRegistries) CountByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+) (int, error) {
+	q := `
+SELECT
+	COUNT(id)
+FROM
+	processing_activity_registries
+WHERE
+	%s
+	AND organization_id = @organization_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	err := row.Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf("cannot count processing activity registries: %w", err)
+	}
+
+	return count, nil
+}
+
+func (p *ProcessingActivityRegistries) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[ProcessingActivityRegistryOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	audit_id,
+	name,
+	purpose,
+	data_subject_category,
+	personal_data_category,
+	special_or_criminal_data,
+	consent_evidence_link,
+	lawful_basis,
+	recipients,
+	location,
+	international_transfers,
+	transfer_safeguards,
+	retention_period,
+	security_measures,
+	data_protection_impact_assessment,
+	transfer_impact_assessment,
+	created_at,
+	updated_at
+FROM
+	processing_activity_registries
+WHERE
+	%s
+	AND organization_id = @organization_id
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query processing activity registries: %w", err)
+	}
+
+	processingActivityRegistries, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ProcessingActivityRegistry])
+	if err != nil {
+		return fmt.Errorf("cannot collect processing activity registries: %w", err)
+	}
+
+	*p = processingActivityRegistries
+
+	return nil
+}
+
+func (p *ProcessingActivityRegistries) CountByAuditID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	auditID gid.GID,
+) (int, error) {
+	q := `
+SELECT
+	COUNT(id)
+FROM
+	processing_activity_registries
+WHERE
+	%s
+	AND audit_id = @audit_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"audit_id": auditID}
+	maps.Copy(args, scope.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	err := row.Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf("cannot count processing activity registries: %w", err)
+	}
+
+	return count, nil
+}
+
+func (p *ProcessingActivityRegistries) LoadByAuditID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	auditID gid.GID,
+	cursor *page.Cursor[ProcessingActivityRegistryOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	audit_id,
+	name,
+	purpose,
+	data_subject_category,
+	personal_data_category,
+	special_or_criminal_data,
+	consent_evidence_link,
+	lawful_basis,
+	recipients,
+	location,
+	international_transfers,
+	transfer_safeguards,
+	retention_period,
+	security_measures,
+	data_protection_impact_assessment,
+	transfer_impact_assessment,
+	created_at,
+	updated_at
+FROM
+	processing_activity_registries
+WHERE
+	%s
+	AND audit_id = @audit_id
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"audit_id": auditID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query processing activity registries: %w", err)
+	}
+
+	processingActivityRegistries, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ProcessingActivityRegistry])
+	if err != nil {
+		return fmt.Errorf("cannot collect processing activity registries: %w", err)
+	}
+
+	*p = processingActivityRegistries
+
+	return nil
+}
+
+func (p *ProcessingActivityRegistry) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO processing_activity_registries (
+	id,
+	tenant_id,
+	organization_id,
+	audit_id,
+	name,
+	purpose,
+	data_subject_category,
+	personal_data_category,
+	special_or_criminal_data,
+	consent_evidence_link,
+	lawful_basis,
+	recipients,
+	location,
+	international_transfers,
+	transfer_safeguards,
+	retention_period,
+	security_measures,
+	data_protection_impact_assessment,
+	transfer_impact_assessment,
+	created_at,
+	updated_at
+) VALUES (
+	@id,
+	@tenant_id,
+	@organization_id,
+	@audit_id,
+	@name,
+	@purpose,
+	@data_subject_category,
+	@personal_data_category,
+	@special_or_criminal_data,
+	@consent_evidence_link,
+	@lawful_basis,
+	@recipients,
+	@location,
+	@international_transfers,
+	@transfer_safeguards,
+	@retention_period,
+	@security_measures,
+	@data_protection_impact_assessment,
+	@transfer_impact_assessment,
+	@created_at,
+	@updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                                p.ID,
+		"tenant_id":                         scope.GetTenantID(),
+		"organization_id":                   p.OrganizationID,
+		"audit_id":                          p.AuditID,
+		"name":                              p.Name,
+		"purpose":                           p.Purpose,
+		"data_subject_category":             p.DataSubjectCategory,
+		"personal_data_category":            p.PersonalDataCategory,
+		"special_or_criminal_data":          p.SpecialOrCriminalData,
+		"consent_evidence_link":             p.ConsentEvidenceLink,
+		"lawful_basis":                      p.LawfulBasis,
+		"recipients":                        p.Recipients,
+		"location":                          p.Location,
+		"international_transfers":           p.InternationalTransfers,
+		"transfer_safeguards":               p.TransferSafeguards,
+		"retention_period":                  p.RetentionPeriod,
+		"security_measures":                 p.SecurityMeasures,
+		"data_protection_impact_assessment": p.DataProtectionImpactAssessment,
+		"transfer_impact_assessment":        p.TransferImpactAssessment,
+		"created_at":                        p.CreatedAt,
+		"updated_at":                        p.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert processing activity registry: %w", err)
+	}
+
+	return nil
+}
+
+func (p *ProcessingActivityRegistry) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE processing_activity_registries
+SET
+	name = @name,
+	purpose = @purpose,
+	audit_id = @audit_id,
+	data_subject_category = @data_subject_category,
+	personal_data_category = @personal_data_category,
+	special_or_criminal_data = @special_or_criminal_data,
+	consent_evidence_link = @consent_evidence_link,
+	lawful_basis = @lawful_basis,
+	recipients = @recipients,
+	location = @location,
+	international_transfers = @international_transfers,
+	transfer_safeguards = @transfer_safeguards,
+	retention_period = @retention_period,
+	security_measures = @security_measures,
+	data_protection_impact_assessment = @data_protection_impact_assessment,
+	transfer_impact_assessment = @transfer_impact_assessment,
+	updated_at = @updated_at
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":                                p.ID,
+		"name":                              p.Name,
+		"purpose":                           p.Purpose,
+		"audit_id":                          p.AuditID,
+		"data_subject_category":             p.DataSubjectCategory,
+		"personal_data_category":            p.PersonalDataCategory,
+		"special_or_criminal_data":          p.SpecialOrCriminalData,
+		"consent_evidence_link":             p.ConsentEvidenceLink,
+		"lawful_basis":                      p.LawfulBasis,
+		"recipients":                        p.Recipients,
+		"location":                          p.Location,
+		"international_transfers":           p.InternationalTransfers,
+		"transfer_safeguards":               p.TransferSafeguards,
+		"retention_period":                  p.RetentionPeriod,
+		"security_measures":                 p.SecurityMeasures,
+		"data_protection_impact_assessment": p.DataProtectionImpactAssessment,
+		"transfer_impact_assessment":        p.TransferImpactAssessment,
+		"updated_at":                        p.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update processing activity registry: %w", err)
+	}
+
+	return nil
+}
+
+func (p *ProcessingActivityRegistry) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM processing_activity_registries
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": p.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete processing activity registry: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/coredata/processing_activity_registry_data_protection_impact_assessment.go
+++ b/pkg/coredata/processing_activity_registry_data_protection_impact_assessment.go
@@ -0,0 +1,57 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type ProcessingActivityRegistryDataProtectionImpactAssessment string
+
+const (
+	ProcessingActivityRegistryDataProtectionImpactAssessmentNeeded    ProcessingActivityRegistryDataProtectionImpactAssessment = "NEEDED"
+	ProcessingActivityRegistryDataProtectionImpactAssessmentNotNeeded ProcessingActivityRegistryDataProtectionImpactAssessment = "NOT_NEEDED"
+)
+
+func (p ProcessingActivityRegistryDataProtectionImpactAssessment) String() string {
+	return string(p)
+}
+
+func (p *ProcessingActivityRegistryDataProtectionImpactAssessment) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for ProcessingActivityRegistryDataProtectionImpactAssessment: %T", value)
+	}
+
+	switch s {
+	case "NEEDED":
+		*p = ProcessingActivityRegistryDataProtectionImpactAssessmentNeeded
+	case "NOT_NEEDED":
+		*p = ProcessingActivityRegistryDataProtectionImpactAssessmentNotNeeded
+	default:
+		return fmt.Errorf("invalid ProcessingActivityRegistryDataProtectionImpactAssessment value: %q", s)
+	}
+	return nil
+}
+
+func (p ProcessingActivityRegistryDataProtectionImpactAssessment) Value() (driver.Value, error) {
+	return p.String(), nil
+}
--- a/pkg/coredata/processing_activity_registry_lawful_basis.go
+++ b/pkg/coredata/processing_activity_registry_lawful_basis.go
@@ -0,0 +1,69 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type ProcessingActivityRegistryLawfulBasis string
+
+const (
+	ProcessingActivityRegistryLawfulBasisLegitimateInterest   ProcessingActivityRegistryLawfulBasis = "LEGITIMATE_INTEREST"
+	ProcessingActivityRegistryLawfulBasisConsent              ProcessingActivityRegistryLawfulBasis = "CONSENT"
+	ProcessingActivityRegistryLawfulBasisContractualNecessity ProcessingActivityRegistryLawfulBasis = "CONTRACTUAL_NECESSITY"
+	ProcessingActivityRegistryLawfulBasisLegalObligation      ProcessingActivityRegistryLawfulBasis = "LEGAL_OBLIGATION"
+	ProcessingActivityRegistryLawfulBasisVitalInterests       ProcessingActivityRegistryLawfulBasis = "VITAL_INTERESTS"
+	ProcessingActivityRegistryLawfulBasisPublicTask           ProcessingActivityRegistryLawfulBasis = "PUBLIC_TASK"
+)
+
+func (p ProcessingActivityRegistryLawfulBasis) String() string {
+	return string(p)
+}
+
+func (p *ProcessingActivityRegistryLawfulBasis) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for ProcessingActivityRegistryLawfulBasis: %T", value)
+	}
+
+	switch s {
+	case "LEGITIMATE_INTEREST":
+		*p = ProcessingActivityRegistryLawfulBasisLegitimateInterest
+	case "CONSENT":
+		*p = ProcessingActivityRegistryLawfulBasisConsent
+	case "CONTRACTUAL_NECESSITY":
+		*p = ProcessingActivityRegistryLawfulBasisContractualNecessity
+	case "LEGAL_OBLIGATION":
+		*p = ProcessingActivityRegistryLawfulBasisLegalObligation
+	case "VITAL_INTERESTS":
+		*p = ProcessingActivityRegistryLawfulBasisVitalInterests
+	case "PUBLIC_TASK":
+		*p = ProcessingActivityRegistryLawfulBasisPublicTask
+	default:
+		return fmt.Errorf("invalid ProcessingActivityRegistryLawfulBasis value: %q", s)
+	}
+	return nil
+}
+
+func (p ProcessingActivityRegistryLawfulBasis) Value() (driver.Value, error) {
+	return p.String(), nil
+}
--- a/pkg/coredata/processing_activity_registry_order_field.go
+++ b/pkg/coredata/processing_activity_registry_order_field.go
@@ -0,0 +1,49 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"fmt"
+)
+
+type ProcessingActivityRegistryOrderField string
+
+const (
+	ProcessingActivityRegistryOrderFieldCreatedAt ProcessingActivityRegistryOrderField = "CREATED_AT"
+	ProcessingActivityRegistryOrderFieldName      ProcessingActivityRegistryOrderField = "NAME"
+)
+
+func (p ProcessingActivityRegistryOrderField) Column() string {
+	return string(p)
+}
+
+func (p ProcessingActivityRegistryOrderField) String() string {
+	return string(p)
+}
+
+func (p ProcessingActivityRegistryOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *ProcessingActivityRegistryOrderField) UnmarshalText(text []byte) error {
+	val := string(text)
+	switch val {
+	case string(ProcessingActivityRegistryOrderFieldCreatedAt),
+		string(ProcessingActivityRegistryOrderFieldName):
+		*p = ProcessingActivityRegistryOrderField(val)
+		return nil
+	}
+	return fmt.Errorf("invalid ProcessingActivityRegistryOrderField value: %q", val)
+}
--- a/pkg/coredata/processing_activity_registry_special_or_criminal_data.go
+++ b/pkg/coredata/processing_activity_registry_special_or_criminal_data.go
@@ -0,0 +1,60 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type ProcessingActivityRegistrySpecialOrCriminalData string
+
+const (
+	ProcessingActivityRegistrySpecialOrCriminalDataYes      ProcessingActivityRegistrySpecialOrCriminalData = "YES"
+	ProcessingActivityRegistrySpecialOrCriminalDataNo       ProcessingActivityRegistrySpecialOrCriminalData = "NO"
+	ProcessingActivityRegistrySpecialOrCriminalDataPossible ProcessingActivityRegistrySpecialOrCriminalData = "POSSIBLE"
+)
+
+func (p ProcessingActivityRegistrySpecialOrCriminalData) String() string {
+	return string(p)
+}
+
+func (p *ProcessingActivityRegistrySpecialOrCriminalData) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for ProcessingActivityRegistrySpecialOrCriminalData: %T", value)
+	}
+
+	switch s {
+	case "YES":
+		*p = ProcessingActivityRegistrySpecialOrCriminalDataYes
+	case "NO":
+		*p = ProcessingActivityRegistrySpecialOrCriminalDataNo
+	case "POSSIBLE":
+		*p = ProcessingActivityRegistrySpecialOrCriminalDataPossible
+	default:
+		return fmt.Errorf("invalid ProcessingActivityRegistrySpecialOrCriminalData value: %q", s)
+	}
+	return nil
+}
+
+func (p ProcessingActivityRegistrySpecialOrCriminalData) Value() (driver.Value, error) {
+	return p.String(), nil
+}
--- a/pkg/coredata/processing_activity_registry_transfer_impact_assessment.go
+++ b/pkg/coredata/processing_activity_registry_transfer_impact_assessment.go
@@ -0,0 +1,57 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type ProcessingActivityRegistryTransferImpactAssessment string
+
+const (
+	ProcessingActivityRegistryTransferImpactAssessmentNeeded    ProcessingActivityRegistryTransferImpactAssessment = "NEEDED"
+	ProcessingActivityRegistryTransferImpactAssessmentNotNeeded ProcessingActivityRegistryTransferImpactAssessment = "NOT_NEEDED"
+)
+
+func (p ProcessingActivityRegistryTransferImpactAssessment) String() string {
+	return string(p)
+}
+
+func (p *ProcessingActivityRegistryTransferImpactAssessment) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for ProcessingActivityRegistryTransferImpactAssessment: %T", value)
+	}
+
+	switch s {
+	case "NEEDED":
+		*p = ProcessingActivityRegistryTransferImpactAssessmentNeeded
+	case "NOT_NEEDED":
+		*p = ProcessingActivityRegistryTransferImpactAssessmentNotNeeded
+	default:
+		return fmt.Errorf("invalid ProcessingActivityRegistryTransferImpactAssessment value: %q", s)
+	}
+	return nil
+}
+
+func (p ProcessingActivityRegistryTransferImpactAssessment) Value() (driver.Value, error) {
+	return p.String(), nil
+}
--- a/pkg/coredata/processing_activity_registry_transfer_safeguards.go
+++ b/pkg/coredata/processing_activity_registry_transfer_safeguards.go
@@ -0,0 +1,69 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type ProcessingActivityRegistryTransferSafeguards string
+
+const (
+	ProcessingActivityRegistryTransferSafeguardsStandardContractualClauses ProcessingActivityRegistryTransferSafeguards = "STANDARD_CONTRACTUAL_CLAUSES"
+	ProcessingActivityRegistryTransferSafeguardsBindingCorporateRules      ProcessingActivityRegistryTransferSafeguards = "BINDING_CORPORATE_RULES"
+	ProcessingActivityRegistryTransferSafeguardsAdequacyDecision           ProcessingActivityRegistryTransferSafeguards = "ADEQUACY_DECISION"
+	ProcessingActivityRegistryTransferSafeguardsDerogations                ProcessingActivityRegistryTransferSafeguards = "DEROGATIONS"
+	ProcessingActivityRegistryTransferSafeguardsCodesOfConduct             ProcessingActivityRegistryTransferSafeguards = "CODES_OF_CONDUCT"
+	ProcessingActivityRegistryTransferSafeguardsCertificationMechanisms    ProcessingActivityRegistryTransferSafeguards = "CERTIFICATION_MECHANISMS"
+)
+
+func (p ProcessingActivityRegistryTransferSafeguards) String() string {
+	return string(p)
+}
+
+func (p *ProcessingActivityRegistryTransferSafeguards) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for ProcessingActivityRegistryTransferSafeguards: %T", value)
+	}
+
+	switch s {
+	case "STANDARD_CONTRACTUAL_CLAUSES":
+		*p = ProcessingActivityRegistryTransferSafeguardsStandardContractualClauses
+	case "BINDING_CORPORATE_RULES":
+		*p = ProcessingActivityRegistryTransferSafeguardsBindingCorporateRules
+	case "ADEQUACY_DECISION":
+		*p = ProcessingActivityRegistryTransferSafeguardsAdequacyDecision
+	case "DEROGATIONS":
+		*p = ProcessingActivityRegistryTransferSafeguardsDerogations
+	case "CODES_OF_CONDUCT":
+		*p = ProcessingActivityRegistryTransferSafeguardsCodesOfConduct
+	case "CERTIFICATION_MECHANISMS":
+		*p = ProcessingActivityRegistryTransferSafeguardsCertificationMechanisms
+	default:
+		return fmt.Errorf("invalid ProcessingActivityRegistryTransferSafeguards value: %q", s)
+	}
+	return nil
+}
+
+func (p ProcessingActivityRegistryTransferSafeguards) Value() (driver.Value, error) {
+	return p.String(), nil
+}
--- a/pkg/probo/processing_activity_registry_service.go
+++ b/pkg/probo/processing_activity_registry_service.go
@@ -0,0 +1,359 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"go.gearno.de/kit/pg"
+)
+
+type ProcessingActivityRegistryService struct {
+	svc *TenantService
+}
+
+type (
+	CreateProcessingActivityRegistryRequest struct {
+		OrganizationID                 gid.GID
+		AuditID                        gid.GID
+		Name                           string
+		Purpose                        *string
+		DataSubjectCategory            *string
+		PersonalDataCategory           *string
+		SpecialOrCriminalData          coredata.ProcessingActivityRegistrySpecialOrCriminalData
+		ConsentEvidenceLink            *string
+		LawfulBasis                    coredata.ProcessingActivityRegistryLawfulBasis
+		Recipients                     *string
+		Location                       *string
+		InternationalTransfers         bool
+		TransferSafeguards             *coredata.ProcessingActivityRegistryTransferSafeguards
+		RetentionPeriod                *string
+		SecurityMeasures               *string
+		DataProtectionImpactAssessment coredata.ProcessingActivityRegistryDataProtectionImpactAssessment
+		TransferImpactAssessment       coredata.ProcessingActivityRegistryTransferImpactAssessment
+	}
+
+	UpdateProcessingActivityRegistryRequest struct {
+		ID                             gid.GID
+		AuditID                        *gid.GID
+		Name                           *string
+		Purpose                        **string
+		DataSubjectCategory            **string
+		PersonalDataCategory           **string
+		SpecialOrCriminalData          *coredata.ProcessingActivityRegistrySpecialOrCriminalData
+		ConsentEvidenceLink            **string
+		LawfulBasis                    *coredata.ProcessingActivityRegistryLawfulBasis
+		Recipients                     **string
+		Location                       **string
+		InternationalTransfers         *bool
+		TransferSafeguards             **coredata.ProcessingActivityRegistryTransferSafeguards
+		RetentionPeriod                **string
+		SecurityMeasures               **string
+		DataProtectionImpactAssessment *coredata.ProcessingActivityRegistryDataProtectionImpactAssessment
+		TransferImpactAssessment       *coredata.ProcessingActivityRegistryTransferImpactAssessment
+	}
+)
+
+func (s ProcessingActivityRegistryService) Get(
+	ctx context.Context,
+	processingActivityRegistryID gid.GID,
+) (*coredata.ProcessingActivityRegistry, error) {
+	processingActivityRegistry := &coredata.ProcessingActivityRegistry{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return processingActivityRegistry.LoadByID(ctx, conn, s.svc.scope, processingActivityRegistryID)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return processingActivityRegistry, nil
+}
+
+func (s *ProcessingActivityRegistryService) Create(
+	ctx context.Context,
+	req *CreateProcessingActivityRegistryRequest,
+) (*coredata.ProcessingActivityRegistry, error) {
+	now := time.Now()
+
+	processingActivityRegistry := &coredata.ProcessingActivityRegistry{
+		ID:                             gid.New(s.svc.scope.GetTenantID(), coredata.ProcessingActivityRegistryEntityType),
+		OrganizationID:                 req.OrganizationID,
+		AuditID:                        req.AuditID,
+		Name:                           req.Name,
+		Purpose:                        req.Purpose,
+		DataSubjectCategory:            req.DataSubjectCategory,
+		PersonalDataCategory:           req.PersonalDataCategory,
+		SpecialOrCriminalData:          req.SpecialOrCriminalData,
+		ConsentEvidenceLink:            req.ConsentEvidenceLink,
+		LawfulBasis:                    req.LawfulBasis,
+		Recipients:                     req.Recipients,
+		Location:                       req.Location,
+		InternationalTransfers:         req.InternationalTransfers,
+		TransferSafeguards:             req.TransferSafeguards,
+		RetentionPeriod:                req.RetentionPeriod,
+		SecurityMeasures:               req.SecurityMeasures,
+		DataProtectionImpactAssessment: req.DataProtectionImpactAssessment,
+		TransferImpactAssessment:       req.TransferImpactAssessment,
+		CreatedAt:                      now,
+		UpdatedAt:                      now,
+	}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			organization := &coredata.Organization{}
+			if err := organization.LoadByID(ctx, conn, s.svc.scope, req.OrganizationID); err != nil {
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			audit := &coredata.Audit{}
+			if err := audit.LoadByID(ctx, conn, s.svc.scope, req.AuditID); err != nil {
+				return fmt.Errorf("cannot load audit: %w", err)
+			}
+
+			if err := processingActivityRegistry.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert processing activity registry: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return processingActivityRegistry, nil
+}
+
+func (s *ProcessingActivityRegistryService) Update(
+	ctx context.Context,
+	req *UpdateProcessingActivityRegistryRequest,
+) (*coredata.ProcessingActivityRegistry, error) {
+	processingActivityRegistry := &coredata.ProcessingActivityRegistry{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := processingActivityRegistry.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load processing activity registry: %w", err)
+			}
+
+			if req.AuditID != nil {
+				audit := &coredata.Audit{}
+				if err := audit.LoadByID(ctx, conn, s.svc.scope, *req.AuditID); err != nil {
+					return fmt.Errorf("cannot load audit: %w", err)
+				}
+				processingActivityRegistry.AuditID = audit.ID
+			}
+
+			if req.Name != nil {
+				processingActivityRegistry.Name = *req.Name
+			}
+			if req.Purpose != nil {
+				processingActivityRegistry.Purpose = *req.Purpose
+			}
+			if req.DataSubjectCategory != nil {
+				processingActivityRegistry.DataSubjectCategory = *req.DataSubjectCategory
+			}
+			if req.PersonalDataCategory != nil {
+				processingActivityRegistry.PersonalDataCategory = *req.PersonalDataCategory
+			}
+			if req.SpecialOrCriminalData != nil {
+				processingActivityRegistry.SpecialOrCriminalData = *req.SpecialOrCriminalData
+			}
+			if req.ConsentEvidenceLink != nil {
+				processingActivityRegistry.ConsentEvidenceLink = *req.ConsentEvidenceLink
+			}
+			if req.LawfulBasis != nil {
+				processingActivityRegistry.LawfulBasis = *req.LawfulBasis
+			}
+			if req.Recipients != nil {
+				processingActivityRegistry.Recipients = *req.Recipients
+			}
+			if req.Location != nil {
+				processingActivityRegistry.Location = *req.Location
+			}
+			if req.InternationalTransfers != nil {
+				processingActivityRegistry.InternationalTransfers = *req.InternationalTransfers
+			}
+			if req.TransferSafeguards != nil {
+				processingActivityRegistry.TransferSafeguards = *req.TransferSafeguards
+			}
+			if req.RetentionPeriod != nil {
+				processingActivityRegistry.RetentionPeriod = *req.RetentionPeriod
+			}
+			if req.SecurityMeasures != nil {
+				processingActivityRegistry.SecurityMeasures = *req.SecurityMeasures
+			}
+			if req.DataProtectionImpactAssessment != nil {
+				processingActivityRegistry.DataProtectionImpactAssessment = *req.DataProtectionImpactAssessment
+			}
+			if req.TransferImpactAssessment != nil {
+				processingActivityRegistry.TransferImpactAssessment = *req.TransferImpactAssessment
+			}
+
+			processingActivityRegistry.UpdatedAt = time.Now()
+
+			if err := processingActivityRegistry.Update(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update processing activity registry: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return processingActivityRegistry, nil
+}
+
+func (s ProcessingActivityRegistryService) Delete(
+	ctx context.Context,
+	processingActivityRegistryID gid.GID,
+) error {
+	processingActivityRegistry := coredata.ProcessingActivityRegistry{ID: processingActivityRegistryID}
+	return s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := processingActivityRegistry.Delete(ctx, conn, s.svc.scope)
+			if err != nil {
+				return fmt.Errorf("cannot delete processing activity registry: %w", err)
+			}
+			return nil
+		},
+	)
+}
+
+func (s ProcessingActivityRegistryService) ListForOrganizationID(
+	ctx context.Context,
+	organizationID gid.GID,
+	cursor *page.Cursor[coredata.ProcessingActivityRegistryOrderField],
+) (*page.Page[*coredata.ProcessingActivityRegistry, coredata.ProcessingActivityRegistryOrderField], error) {
+	var processingActivityRegistries coredata.ProcessingActivityRegistries
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := processingActivityRegistries.LoadByOrganizationID(ctx, conn, s.svc.scope, organizationID, cursor)
+			if err != nil {
+				return fmt.Errorf("cannot load processing activity registries: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(processingActivityRegistries, cursor), nil
+}
+
+func (s ProcessingActivityRegistryService) CountForOrganizationID(
+	ctx context.Context,
+	organizationID gid.GID,
+) (int, error) {
+	var count int
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) (err error) {
+			processingActivityRegistries := coredata.ProcessingActivityRegistries{}
+			count, err = processingActivityRegistries.CountByOrganizationID(ctx, conn, s.svc.scope, organizationID)
+			if err != nil {
+				return fmt.Errorf("cannot count processing activity registries: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return 0, err
+	}
+
+	return count, nil
+}
+
+func (s ProcessingActivityRegistryService) ListForAuditID(
+	ctx context.Context,
+	auditID gid.GID,
+	cursor *page.Cursor[coredata.ProcessingActivityRegistryOrderField],
+) (*page.Page[*coredata.ProcessingActivityRegistry, coredata.ProcessingActivityRegistryOrderField], error) {
+	var processingActivityRegistries coredata.ProcessingActivityRegistries
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			audit := &coredata.Audit{}
+			if err := audit.LoadByID(ctx, conn, s.svc.scope, auditID); err != nil {
+				return fmt.Errorf("cannot load audit: %w", err)
+			}
+
+			err := processingActivityRegistries.LoadByAuditID(ctx, conn, s.svc.scope, audit.ID, cursor)
+			if err != nil {
+				return fmt.Errorf("cannot load processing activity registries: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(processingActivityRegistries, cursor), nil
+}
+
+func (s ProcessingActivityRegistryService) CountForAuditID(
+	ctx context.Context,
+	auditID gid.GID,
+) (int, error) {
+	var count int
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) (err error) {
+			processingActivityRegistries := coredata.ProcessingActivityRegistries{}
+			count, err = processingActivityRegistries.CountByAuditID(ctx, conn, s.svc.scope, auditID)
+			if err != nil {
+				return fmt.Errorf("cannot count processing activity registries: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return 0, err
+	}
+
+	return count, nil
+}
--- a/pkg/probo/service.go
+++ b/pkg/probo/service.go
@@ -86,6 +86,7 @@ type (
 		ComplianceRegistries              *ComplianceRegistryService
 		Snapshots                         *SnapshotService
 		ContinualImprovementRegistries    *ContinualImprovementRegistriesService
+		ProcessingActivityRegistries      *ProcessingActivityRegistryService
 	}
 )

@@ -180,5 +181,6 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.ComplianceRegistries = &ComplianceRegistryService{svc: tenantService}
 	tenantService.Snapshots = &SnapshotService{svc: tenantService}
 	tenantService.ContinualImprovementRegistries = &ContinualImprovementRegistriesService{svc: tenantService}
+	tenantService.ProcessingActivityRegistries = &ProcessingActivityRegistryService{svc: tenantService}
 	return tenantService
 }
--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -215,6 +215,102 @@ enum ContinualImprovementRegistriesPriority
    )
 }

+enum ProcessingActivityRegistrySpecialOrCriminalData
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistrySpecialOrCriminalData") {
+  YES
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistrySpecialOrCriminalDataYes"
+    )
+  NO
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistrySpecialOrCriminalDataNo"
+    )
+  POSSIBLE
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistrySpecialOrCriminalDataPossible"
+    )
+}
+
+enum ProcessingActivityRegistryLawfulBasis
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryLawfulBasis") {
+  LEGITIMATE_INTEREST
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryLawfulBasisLegitimateInterest"
+    )
+  CONSENT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryLawfulBasisConsent"
+    )
+  CONTRACTUAL_NECESSITY
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryLawfulBasisContractualNecessity"
+    )
+  LEGAL_OBLIGATION
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryLawfulBasisLegalObligation"
+    )
+  VITAL_INTERESTS
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryLawfulBasisVitalInterests"
+    )
+  PUBLIC_TASK
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryLawfulBasisPublicTask"
+    )
+}
+
+enum ProcessingActivityRegistryTransferSafeguards
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryTransferSafeguards") {
+  STANDARD_CONTRACTUAL_CLAUSES
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryTransferSafeguardsStandardContractualClauses"
+    )
+  BINDING_CORPORATE_RULES
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryTransferSafeguardsBindingCorporateRules"
+    )
+  ADEQUACY_DECISION
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryTransferSafeguardsAdequacyDecision"
+    )
+  DEROGATIONS
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryTransferSafeguardsDerogations"
+    )
+  CODES_OF_CONDUCT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryTransferSafeguardsCodesOfConduct"
+    )
+  CERTIFICATION_MECHANISMS
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryTransferSafeguardsCertificationMechanisms"
+    )
+}
+
+enum ProcessingActivityRegistryDataProtectionImpactAssessment
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryDataProtectionImpactAssessment") {
+  NEEDED
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryDataProtectionImpactAssessmentNeeded"
+    )
+  NOT_NEEDED
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryDataProtectionImpactAssessmentNotNeeded"
+    )
+}
+
+enum ProcessingActivityRegistryTransferImpactAssessment
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryTransferImpactAssessment") {
+  NEEDED
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryTransferImpactAssessmentNeeded"
+    )
+  NOT_NEEDED
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryTransferImpactAssessmentNotNeeded"
+    )
+}
+
 # Order Field Enums
 enum UserOrderField
  @goModel(model: "github.com/getprobo/probo/pkg/coredata.UserOrderField") {
@@ -734,6 +830,18 @@ enum ContinualImprovementRegistriesOrderField
    )
 }

+enum ProcessingActivityRegistryOrderField
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryOrderField") {
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryOrderFieldCreatedAt"
+    )
+  NAME
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.ProcessingActivityRegistryOrderFieldName"
+    )
+}
+
 enum TrustCenterAccessOrderField
  @goModel(model: "github.com/getprobo/probo/pkg/coredata.TrustCenterAccessOrderField") {
  CREATED_AT
@@ -891,6 +999,14 @@ input ContinualImprovementRegistriesOrder
  field: ContinualImprovementRegistriesOrderField!
 }

+input ProcessingActivityRegistryOrder
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.ProcessingActivityRegistryOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: ProcessingActivityRegistryOrderField!
+}
+
 input TrustCenterAccessOrder
  @goModel(
    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.TrustCenterAccessOrderBy"
@@ -986,10 +1102,6 @@ input OrganizationFilter {
  trustCenterSlug: String
 }

-input TrustCenterFilter {
-  slug: String
-}
-
 input DatumFilter {
  snapshotId: ID
 }
@@ -1151,6 +1263,14 @@ type Organization implements Node {
    orderBy: ContinualImprovementRegistriesOrder
  ): ContinualImprovementRegistryConnection! @goField(forceResolver: true)

+  processingActivityRegistries(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ProcessingActivityRegistryOrder
+  ): ProcessingActivityRegistryConnection! @goField(forceResolver: true)
+
  snapshots(
    first: Int
    after: CursorKey
@@ -1571,6 +1691,14 @@ type Audit implements Node {
    filter: ControlFilter
  ): ControlConnection! @goField(forceResolver: true)

+  processingActivityRegistries(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ProcessingActivityRegistryOrder
+  ): ProcessingActivityRegistryConnection! @goField(forceResolver: true)
+
  showOnTrustCenter: Boolean!
  createdAt: Datetime!
  updatedAt: Datetime!
@@ -1626,6 +1754,29 @@ type ContinualImprovementRegistry implements Node {
  updatedAt: Datetime!
 }

+type ProcessingActivityRegistry implements Node {
+  id: ID!
+  organization: Organization! @goField(forceResolver: true)
+  audit: Audit! @goField(forceResolver: true)
+  name: String!
+  purpose: String
+  dataSubjectCategory: String
+  personalDataCategory: String
+  specialOrCriminalData: ProcessingActivityRegistrySpecialOrCriminalData!
+  consentEvidenceLink: String
+  lawfulBasis: ProcessingActivityRegistryLawfulBasis!
+  recipients: String
+  location: String
+  internationalTransfers: Boolean!
+  transferSafeguards: ProcessingActivityRegistryTransferSafeguards
+  retentionPeriod: String
+  securityMeasures: String
+  dataProtectionImpactAssessment: ProcessingActivityRegistryDataProtectionImpactAssessment!
+  transferImpactAssessment: ProcessingActivityRegistryTransferImpactAssessment!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Snapshot implements Node {
  id: ID!
  organization: Organization! @goField(forceResolver: true)
@@ -1981,6 +2132,20 @@ type ContinualImprovementRegistryEdge {
  node: ContinualImprovementRegistry!
 }

+type ProcessingActivityRegistryConnection
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.ProcessingActivityRegistryConnection"
+  ) {
+  totalCount: Int! @goField(forceResolver: true)
+  edges: [ProcessingActivityRegistryEdge!]!
+  pageInfo: PageInfo!
+}
+
+type ProcessingActivityRegistryEdge {
+  cursor: CursorKey!
+  node: ProcessingActivityRegistry!
+}
+
 type SnapshotConnection
  @goModel(
    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.SnapshotConnection"
@@ -1999,13 +2164,6 @@ type SnapshotEdge {
 type Query {
  node(id: ID!): Node!
  viewer: Viewer!
-  trustCenters(
-    first: Int
-    after: CursorKey
-    last: Int
-    before: CursorKey
-    filter: TrustCenterFilter
-  ): TrustCenterConnection! @goField(forceResolver: true)
 }

 type Mutation {
@@ -2263,6 +2421,17 @@ type Mutation {
    input: DeleteContinualImprovementRegistryInput!
  ): DeleteContinualImprovementRegistryPayload!

+  # Processing Activity Registry mutations
+  createProcessingActivityRegistry(
+    input: CreateProcessingActivityRegistryInput!
+  ): CreateProcessingActivityRegistryPayload!
+  updateProcessingActivityRegistry(
+    input: UpdateProcessingActivityRegistryInput!
+  ): UpdateProcessingActivityRegistryPayload!
+  deleteProcessingActivityRegistry(
+    input: DeleteProcessingActivityRegistryInput!
+  ): DeleteProcessingActivityRegistryPayload!
+
  # Snapshot mutations
  createSnapshot(input: CreateSnapshotInput!): CreateSnapshotPayload!
  deleteSnapshot(input: DeleteSnapshotInput!): DeleteSnapshotPayload!
@@ -2859,6 +3028,50 @@ input DeleteContinualImprovementRegistryInput {
  continualImprovementRegistryId: ID!
 }

+input CreateProcessingActivityRegistryInput {
+  organizationId: ID!
+  auditId: ID!
+  name: String!
+  purpose: String
+  dataSubjectCategory: String
+  personalDataCategory: String
+  specialOrCriminalData: ProcessingActivityRegistrySpecialOrCriminalData!
+  consentEvidenceLink: String
+  lawfulBasis: ProcessingActivityRegistryLawfulBasis!
+  recipients: String
+  location: String
+  internationalTransfers: Boolean!
+  transferSafeguards: ProcessingActivityRegistryTransferSafeguards
+  retentionPeriod: String
+  securityMeasures: String
+  dataProtectionImpactAssessment: ProcessingActivityRegistryDataProtectionImpactAssessment!
+  transferImpactAssessment: ProcessingActivityRegistryTransferImpactAssessment!
+}
+
+input UpdateProcessingActivityRegistryInput {
+  id: ID!
+  auditId: ID
+  name: String
+  purpose: String
+  dataSubjectCategory: String
+  personalDataCategory: String
+  specialOrCriminalData: ProcessingActivityRegistrySpecialOrCriminalData
+  consentEvidenceLink: String
+  lawfulBasis: ProcessingActivityRegistryLawfulBasis
+  recipients: String
+  location: String
+  internationalTransfers: Boolean
+  transferSafeguards: ProcessingActivityRegistryTransferSafeguards
+  retentionPeriod: String
+  securityMeasures: String
+  dataProtectionImpactAssessment: ProcessingActivityRegistryDataProtectionImpactAssessment
+  transferImpactAssessment: ProcessingActivityRegistryTransferImpactAssessment
+}
+
+input DeleteProcessingActivityRegistryInput {
+  processingActivityRegistryId: ID!
+}
+
 input CreateSnapshotInput {
  organizationId: ID!
  name: String!
@@ -2887,8 +3100,6 @@ type UpdateTrustCenterPayload {
  trustCenter: TrustCenter!
 }

-
-
 type CreateTrustCenterAccessPayload {
  trustCenterAccessEdge: TrustCenterAccessEdge!
 }
@@ -3602,6 +3813,18 @@ type DeleteContinualImprovementRegistryPayload {
  deletedContinualImprovementRegistryId: ID!
 }

+type CreateProcessingActivityRegistryPayload {
+  processingActivityRegistryEdge: ProcessingActivityRegistryEdge!
+}
+
+type UpdateProcessingActivityRegistryPayload {
+  processingActivityRegistry: ProcessingActivityRegistry!
+}
+
+type DeleteProcessingActivityRegistryPayload {
+  deletedProcessingActivityRegistryId: ID!
+}
+
 type CreateSnapshotPayload {
  snapshotEdge: SnapshotEdge!
 }
--- a/pkg/server/api/console/v1/schema/schema.go
+++ b/pkg/server/api/console/v1/schema/schema.go
--- a/pkg/server/api/console/v1/types/processing_activity_registry.go
+++ b/pkg/server/api/console/v1/types/processing_activity_registry.go
@@ -0,0 +1,83 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+type (
+	ProcessingActivityRegistryOrderBy OrderBy[coredata.ProcessingActivityRegistryOrderField]
+
+	ProcessingActivityRegistryConnection struct {
+		TotalCount int
+		Edges      []*ProcessingActivityRegistryEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+	}
+)
+
+func NewProcessingActivityRegistryConnection(
+	p *page.Page[*coredata.ProcessingActivityRegistry, coredata.ProcessingActivityRegistryOrderField],
+	parentType any,
+	parentID gid.GID,
+) *ProcessingActivityRegistryConnection {
+	edges := make([]*ProcessingActivityRegistryEdge, len(p.Data))
+	for i, registry := range p.Data {
+		edges[i] = NewProcessingActivityRegistryEdge(registry, p.Cursor.OrderBy.Field)
+	}
+
+	return &ProcessingActivityRegistryConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: parentType,
+		ParentID: parentID,
+	}
+}
+
+func NewProcessingActivityRegistry(par *coredata.ProcessingActivityRegistry) *ProcessingActivityRegistry {
+	return &ProcessingActivityRegistry{
+		ID:                             par.ID,
+		Name:                           par.Name,
+		Purpose:                        par.Purpose,
+		DataSubjectCategory:            par.DataSubjectCategory,
+		PersonalDataCategory:           par.PersonalDataCategory,
+		SpecialOrCriminalData:          par.SpecialOrCriminalData,
+		ConsentEvidenceLink:            par.ConsentEvidenceLink,
+		LawfulBasis:                    par.LawfulBasis,
+		Recipients:                     par.Recipients,
+		Location:                       par.Location,
+		InternationalTransfers:         par.InternationalTransfers,
+		TransferSafeguards:             par.TransferSafeguards,
+		RetentionPeriod:                par.RetentionPeriod,
+		SecurityMeasures:               par.SecurityMeasures,
+		DataProtectionImpactAssessment: par.DataProtectionImpactAssessment,
+		TransferImpactAssessment:       par.TransferImpactAssessment,
+		CreatedAt:                      par.CreatedAt,
+		UpdatedAt:                      par.UpdatedAt,
+	}
+}
+
+func NewProcessingActivityRegistryEdge(par *coredata.ProcessingActivityRegistry, orderField coredata.ProcessingActivityRegistryOrderField) *ProcessingActivityRegistryEdge {
+	return &ProcessingActivityRegistryEdge{
+		Node:   NewProcessingActivityRegistry(par),
+		Cursor: par.CursorKey(orderField),
+	}
+}
--- a/pkg/server/api/console/v1/types/types.go
+++ b/pkg/server/api/console/v1/types/types.go
@@ -57,19 +57,20 @@ type AssignTaskPayload struct {
 }

 type Audit struct {
-	ID                gid.GID             `json:"id"`
-	Name              *string             `json:"name,omitempty"`
-	Organization      *Organization       `json:"organization"`
-	Framework         *Framework          `json:"framework"`
-	ValidFrom         *time.Time          `json:"validFrom,omitempty"`
-	ValidUntil        *time.Time          `json:"validUntil,omitempty"`
-	Report            *Report             `json:"report,omitempty"`
-	ReportURL         *string             `json:"reportUrl,omitempty"`
-	State             coredata.AuditState `json:"state"`
-	Controls          *ControlConnection  `json:"controls"`
-	ShowOnTrustCenter bool                `json:"showOnTrustCenter"`
-	CreatedAt         time.Time           `json:"createdAt"`
-	UpdatedAt         time.Time           `json:"updatedAt"`
+	ID                           gid.GID                               `json:"id"`
+	Name                         *string                               `json:"name,omitempty"`
+	Organization                 *Organization                         `json:"organization"`
+	Framework                    *Framework                            `json:"framework"`
+	ValidFrom                    *time.Time                            `json:"validFrom,omitempty"`
+	ValidUntil                   *time.Time                            `json:"validUntil,omitempty"`
+	Report                       *Report                               `json:"report,omitempty"`
+	ReportURL                    *string                               `json:"reportUrl,omitempty"`
+	State                        coredata.AuditState                   `json:"state"`
+	Controls                     *ControlConnection                    `json:"controls"`
+	ProcessingActivityRegistries *ProcessingActivityRegistryConnection `json:"processingActivityRegistries"`
+	ShowOnTrustCenter            bool                                  `json:"showOnTrustCenter"`
+	CreatedAt                    time.Time                             `json:"createdAt"`
+	UpdatedAt                    time.Time                             `json:"updatedAt"`
 }

 func (Audit) IsNode()             {}
@@ -442,6 +443,30 @@ type CreatePeoplePayload struct {
 	PeopleEdge *PeopleEdge `json:"peopleEdge"`
 }

+type CreateProcessingActivityRegistryInput struct {
+	OrganizationID                 gid.GID                                                           `json:"organizationId"`
+	AuditID                        gid.GID                                                           `json:"auditId"`
+	Name                           string                                                            `json:"name"`
+	Purpose                        *string                                                           `json:"purpose,omitempty"`
+	DataSubjectCategory            *string                                                           `json:"dataSubjectCategory,omitempty"`
+	PersonalDataCategory           *string                                                           `json:"personalDataCategory,omitempty"`
+	SpecialOrCriminalData          coredata.ProcessingActivityRegistrySpecialOrCriminalData          `json:"specialOrCriminalData"`
+	ConsentEvidenceLink            *string                                                           `json:"consentEvidenceLink,omitempty"`
+	LawfulBasis                    coredata.ProcessingActivityRegistryLawfulBasis                    `json:"lawfulBasis"`
+	Recipients                     *string                                                           `json:"recipients,omitempty"`
+	Location                       *string                                                           `json:"location,omitempty"`
+	InternationalTransfers         bool                                                              `json:"internationalTransfers"`
+	TransferSafeguards             *coredata.ProcessingActivityRegistryTransferSafeguards            `json:"transferSafeguards,omitempty"`
+	RetentionPeriod                *string                                                           `json:"retentionPeriod,omitempty"`
+	SecurityMeasures               *string                                                           `json:"securityMeasures,omitempty"`
+	DataProtectionImpactAssessment coredata.ProcessingActivityRegistryDataProtectionImpactAssessment `json:"dataProtectionImpactAssessment"`
+	TransferImpactAssessment       coredata.ProcessingActivityRegistryTransferImpactAssessment       `json:"transferImpactAssessment"`
+}
+
+type CreateProcessingActivityRegistryPayload struct {
+	ProcessingActivityRegistryEdge *ProcessingActivityRegistryEdge `json:"processingActivityRegistryEdge"`
+}
+
 type CreateRiskDocumentMappingInput struct {
 	RiskID     gid.GID `json:"riskId"`
 	DocumentID gid.GID `json:"documentId"`
@@ -762,6 +787,14 @@ type DeletePeoplePayload struct {
 	DeletedPeopleID gid.GID `json:"deletedPeopleId"`
 }

+type DeleteProcessingActivityRegistryInput struct {
+	ProcessingActivityRegistryID gid.GID `json:"processingActivityRegistryId"`
+}
+
+type DeleteProcessingActivityRegistryPayload struct {
+	DeletedProcessingActivityRegistryID gid.GID `json:"deletedProcessingActivityRegistryId"`
+}
+
 type DeleteRiskDocumentMappingInput struct {
 	RiskID     gid.GID `json:"riskId"`
 	DocumentID gid.GID `json:"documentId"`
@@ -1131,6 +1164,7 @@ type Organization struct {
 	NonconformityRegistries        *NonconformityRegistryConnection        `json:"nonconformityRegistries"`
 	ComplianceRegistries           *ComplianceRegistryConnection           `json:"complianceRegistries"`
 	ContinualImprovementRegistries *ContinualImprovementRegistryConnection `json:"continualImprovementRegistries"`
+	ProcessingActivityRegistries   *ProcessingActivityRegistryConnection   `json:"processingActivityRegistries"`
 	Snapshots                      *SnapshotConnection                     `json:"snapshots"`
 	TrustCenter                    *TrustCenter                            `json:"trustCenter,omitempty"`
 	CreatedAt                      time.Time                               `json:"createdAt"`
@@ -1191,6 +1225,37 @@ type PeopleFilter struct {
 	ExcludeContractEnded *bool `json:"excludeContractEnded,omitempty"`
 }

+type ProcessingActivityRegistry struct {
+	ID                             gid.GID                                                           `json:"id"`
+	Organization                   *Organization                                                     `json:"organization"`
+	Audit                          *Audit                                                            `json:"audit"`
+	Name                           string                                                            `json:"name"`
+	Purpose                        *string                                                           `json:"purpose,omitempty"`
+	DataSubjectCategory            *string                                                           `json:"dataSubjectCategory,omitempty"`
+	PersonalDataCategory           *string                                                           `json:"personalDataCategory,omitempty"`
+	SpecialOrCriminalData          coredata.ProcessingActivityRegistrySpecialOrCriminalData          `json:"specialOrCriminalData"`
+	ConsentEvidenceLink            *string                                                           `json:"consentEvidenceLink,omitempty"`
+	LawfulBasis                    coredata.ProcessingActivityRegistryLawfulBasis                    `json:"lawfulBasis"`
+	Recipients                     *string                                                           `json:"recipients,omitempty"`
+	Location                       *string                                                           `json:"location,omitempty"`
+	InternationalTransfers         bool                                                              `json:"internationalTransfers"`
+	TransferSafeguards             *coredata.ProcessingActivityRegistryTransferSafeguards            `json:"transferSafeguards,omitempty"`
+	RetentionPeriod                *string                                                           `json:"retentionPeriod,omitempty"`
+	SecurityMeasures               *string                                                           `json:"securityMeasures,omitempty"`
+	DataProtectionImpactAssessment coredata.ProcessingActivityRegistryDataProtectionImpactAssessment `json:"dataProtectionImpactAssessment"`
+	TransferImpactAssessment       coredata.ProcessingActivityRegistryTransferImpactAssessment       `json:"transferImpactAssessment"`
+	CreatedAt                      time.Time                                                         `json:"createdAt"`
+	UpdatedAt                      time.Time                                                         `json:"updatedAt"`
+}
+
+func (ProcessingActivityRegistry) IsNode()             {}
+func (this ProcessingActivityRegistry) GetID() gid.GID { return this.ID }
+
+type ProcessingActivityRegistryEdge struct {
+	Cursor page.CursorKey              `json:"cursor"`
+	Node   *ProcessingActivityRegistry `json:"node"`
+}
+
 type PublishDocumentVersionInput struct {
 	DocumentID gid.GID `json:"documentId"`
 	Changelog  *string `json:"changelog,omitempty"`
@@ -1380,10 +1445,6 @@ type TrustCenterEdge struct {
 	Node   *TrustCenter   `json:"node"`
 }

-type TrustCenterFilter struct {
-	Slug *string `json:"slug,omitempty"`
-}
-
 type UnassignTaskInput struct {
 	TaskID gid.GID `json:"taskId"`
 }
@@ -1568,6 +1629,30 @@ type UpdatePeoplePayload struct {
 	People *People `json:"people"`
 }

+type UpdateProcessingActivityRegistryInput struct {
+	ID                             gid.GID                                                            `json:"id"`
+	AuditID                        *gid.GID                                                           `json:"auditId,omitempty"`
+	Name                           *string                                                            `json:"name,omitempty"`
+	Purpose                        *string                                                            `json:"purpose,omitempty"`
+	DataSubjectCategory            *string                                                            `json:"dataSubjectCategory,omitempty"`
+	PersonalDataCategory           *string                                                            `json:"personalDataCategory,omitempty"`
+	SpecialOrCriminalData          *coredata.ProcessingActivityRegistrySpecialOrCriminalData          `json:"specialOrCriminalData,omitempty"`
+	ConsentEvidenceLink            *string                                                            `json:"consentEvidenceLink,omitempty"`
+	LawfulBasis                    *coredata.ProcessingActivityRegistryLawfulBasis                    `json:"lawfulBasis,omitempty"`
+	Recipients                     *string                                                            `json:"recipients,omitempty"`
+	Location                       *string                                                            `json:"location,omitempty"`
+	InternationalTransfers         *bool                                                              `json:"internationalTransfers,omitempty"`
+	TransferSafeguards             *coredata.ProcessingActivityRegistryTransferSafeguards             `json:"transferSafeguards,omitempty"`
+	RetentionPeriod                *string                                                            `json:"retentionPeriod,omitempty"`
+	SecurityMeasures               *string                                                            `json:"securityMeasures,omitempty"`
+	DataProtectionImpactAssessment *coredata.ProcessingActivityRegistryDataProtectionImpactAssessment `json:"dataProtectionImpactAssessment,omitempty"`
+	TransferImpactAssessment       *coredata.ProcessingActivityRegistryTransferImpactAssessment       `json:"transferImpactAssessment,omitempty"`
+}
+
+type UpdateProcessingActivityRegistryPayload struct {
+	ProcessingActivityRegistry *ProcessingActivityRegistry `json:"processingActivityRegistry"`
+}
+
 type UpdateRiskInput struct {
 	ID                 gid.GID                 `json:"id"`
 	Name               *string                 `json:"name,omitempty"`
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -209,6 +209,31 @@ func (r *auditResolver) Controls(ctx context.Context, obj *types.Audit, first *i
 	return types.NewControlConnection(page, r, obj.ID, controlFilter), nil
 }

+// ProcessingActivityRegistries is the resolver for the processingActivityRegistries field.
+func (r *auditResolver) ProcessingActivityRegistries(ctx context.Context, obj *types.Audit, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProcessingActivityRegistryOrderBy) (*types.ProcessingActivityRegistryConnection, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.ProcessingActivityRegistryOrderField]{
+		Field:     coredata.ProcessingActivityRegistryOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.ProcessingActivityRegistryOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := prb.ProcessingActivityRegistries.ListForAuditID(ctx, obj.ID, cursor)
+	if err != nil {
+		return nil, fmt.Errorf("cannot list processing activity registries: %w", err)
+	}
+
+	return types.NewProcessingActivityRegistryConnection(page, r, obj.ID), nil
+}
+
 // TotalCount is the resolver for the totalCount field.
 func (r *auditConnectionResolver) TotalCount(ctx context.Context, obj *types.AuditConnection) (int, error) {
 	prb := r.ProboService(ctx, obj.ParentID.TenantID())
@@ -3184,6 +3209,86 @@ func (r *mutationResolver) DeleteContinualImprovementRegistry(ctx context.Contex
 	}, nil
 }

+// CreateProcessingActivityRegistry is the resolver for the createProcessingActivityRegistry field.
+func (r *mutationResolver) CreateProcessingActivityRegistry(ctx context.Context, input types.CreateProcessingActivityRegistryInput) (*types.CreateProcessingActivityRegistryPayload, error) {
+	prb := r.ProboService(ctx, input.OrganizationID.TenantID())
+
+	req := probo.CreateProcessingActivityRegistryRequest{
+		OrganizationID:                 input.OrganizationID,
+		Name:                           input.Name,
+		Purpose:                        input.Purpose,
+		DataSubjectCategory:            input.DataSubjectCategory,
+		PersonalDataCategory:           input.PersonalDataCategory,
+		SpecialOrCriminalData:          input.SpecialOrCriminalData,
+		LawfulBasis:                    input.LawfulBasis,
+		Recipients:                     input.Recipients,
+		Location:                       input.Location,
+		InternationalTransfers:         input.InternationalTransfers,
+		TransferSafeguards:             input.TransferSafeguards,
+		RetentionPeriod:                input.RetentionPeriod,
+		SecurityMeasures:               input.SecurityMeasures,
+		DataProtectionImpactAssessment: input.DataProtectionImpactAssessment,
+		TransferImpactAssessment:       input.TransferImpactAssessment,
+		AuditID:                        input.AuditID,
+	}
+
+	registry, err := prb.ProcessingActivityRegistries.Create(ctx, &req)
+	if err != nil {
+		panic(fmt.Errorf("cannot create processing activity registry: %w", err))
+	}
+
+	return &types.CreateProcessingActivityRegistryPayload{
+		ProcessingActivityRegistryEdge: types.NewProcessingActivityRegistryEdge(registry, coredata.ProcessingActivityRegistryOrderFieldCreatedAt),
+	}, nil
+}
+
+// UpdateProcessingActivityRegistry is the resolver for the updateProcessingActivityRegistry field.
+func (r *mutationResolver) UpdateProcessingActivityRegistry(ctx context.Context, input types.UpdateProcessingActivityRegistryInput) (*types.UpdateProcessingActivityRegistryPayload, error) {
+	prb := r.ProboService(ctx, input.ID.TenantID())
+
+	req := probo.UpdateProcessingActivityRegistryRequest{
+		ID:                             input.ID,
+		Name:                           input.Name,
+		Purpose:                        &input.Purpose,
+		DataSubjectCategory:            &input.DataSubjectCategory,
+		PersonalDataCategory:           &input.PersonalDataCategory,
+		SpecialOrCriminalData:          input.SpecialOrCriminalData,
+		LawfulBasis:                    input.LawfulBasis,
+		Recipients:                     &input.Recipients,
+		Location:                       &input.Location,
+		InternationalTransfers:         input.InternationalTransfers,
+		TransferSafeguards:             &input.TransferSafeguards,
+		RetentionPeriod:                &input.RetentionPeriod,
+		SecurityMeasures:               &input.SecurityMeasures,
+		DataProtectionImpactAssessment: input.DataProtectionImpactAssessment,
+		TransferImpactAssessment:       input.TransferImpactAssessment,
+		AuditID:                        input.AuditID,
+	}
+
+	registry, err := prb.ProcessingActivityRegistries.Update(ctx, &req)
+	if err != nil {
+		panic(fmt.Errorf("cannot update processing activity registry: %w", err))
+	}
+
+	return &types.UpdateProcessingActivityRegistryPayload{
+		ProcessingActivityRegistry: types.NewProcessingActivityRegistry(registry),
+	}, nil
+}
+
+// DeleteProcessingActivityRegistry is the resolver for the deleteProcessingActivityRegistry field.
+func (r *mutationResolver) DeleteProcessingActivityRegistry(ctx context.Context, input types.DeleteProcessingActivityRegistryInput) (*types.DeleteProcessingActivityRegistryPayload, error) {
+	prb := r.ProboService(ctx, input.ProcessingActivityRegistryID.TenantID())
+
+	err := prb.ProcessingActivityRegistries.Delete(ctx, input.ProcessingActivityRegistryID)
+	if err != nil {
+		panic(fmt.Errorf("cannot delete processing activity registry: %w", err))
+	}
+
+	return &types.DeleteProcessingActivityRegistryPayload{
+		DeletedProcessingActivityRegistryID: input.ProcessingActivityRegistryID,
+	}, nil
+}
+
 // CreateSnapshot is the resolver for the createSnapshot field.
 func (r *mutationResolver) CreateSnapshot(ctx context.Context, input types.CreateSnapshotInput) (*types.CreateSnapshotPayload, error) {
 	prb := r.ProboService(ctx, input.OrganizationID.TenantID())
@@ -3721,6 +3826,32 @@ func (r *organizationResolver) ContinualImprovementRegistries(ctx context.Contex
 	return types.NewContinualImprovementRegistryConnection(page, r, obj.ID), nil
 }

+// ProcessingActivityRegistries is the resolver for the processingActivityRegistries field.
+func (r *organizationResolver) ProcessingActivityRegistries(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProcessingActivityRegistryOrderBy) (*types.ProcessingActivityRegistryConnection, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.ProcessingActivityRegistryOrderField]{
+		Field:     coredata.ProcessingActivityRegistryOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.ProcessingActivityRegistryOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := prb.ProcessingActivityRegistries.ListForOrganizationID(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list organization processing activity registries: %w", err))
+	}
+
+	return types.NewProcessingActivityRegistryConnection(page, r, obj.ID), nil
+}
+
 // Snapshots is the resolver for the snapshots field.
 func (r *organizationResolver) Snapshots(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SnapshotOrderBy) (*types.SnapshotConnection, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -3774,6 +3905,62 @@ func (r *peopleConnectionResolver) TotalCount(ctx context.Context, obj *types.Pe
 	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
 }

+// Organization is the resolver for the organization field.
+func (r *processingActivityRegistryResolver) Organization(ctx context.Context, obj *types.ProcessingActivityRegistry) (*types.Organization, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	processingActivityRegistry, err := prb.ProcessingActivityRegistries.Get(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get processing activity registry: %w", err))
+	}
+
+	organization, err := prb.Organizations.Get(ctx, processingActivityRegistry.OrganizationID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get organization: %w", err))
+	}
+
+	return types.NewOrganization(organization), nil
+}
+
+// Audit is the resolver for the audit field.
+func (r *processingActivityRegistryResolver) Audit(ctx context.Context, obj *types.ProcessingActivityRegistry) (*types.Audit, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	processingActivityRegistry, err := prb.ProcessingActivityRegistries.Get(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get processing activity registry: %w", err))
+	}
+
+	audit, err := prb.Audits.Get(ctx, processingActivityRegistry.AuditID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot get audit: %w", err)
+	}
+
+	return types.NewAudit(audit), nil
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *processingActivityRegistryConnectionResolver) TotalCount(ctx context.Context, obj *types.ProcessingActivityRegistryConnection) (int, error) {
+	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+
+	switch obj.Resolver.(type) {
+	case *organizationResolver:
+		count, err := prb.ProcessingActivityRegistries.CountForOrganizationID(ctx, obj.ParentID)
+		if err != nil {
+			panic(fmt.Errorf("cannot count organization processing activity registries: %w", err))
+		}
+		return count, nil
+	case *auditResolver:
+		count, err := prb.ProcessingActivityRegistries.CountForAuditID(ctx, obj.ParentID)
+		if err != nil {
+			panic(fmt.Errorf("cannot count audit processing activity registries: %w", err))
+		}
+		return count, nil
+	}
+
+	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
+}
+
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
 	prb := r.ProboService(ctx, id.TenantID())
@@ -3919,6 +4106,12 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 			panic(fmt.Errorf("cannot get report: %w", err))
 		}
 		return types.NewReport(report), nil
+	case coredata.ProcessingActivityRegistryEntityType:
+		processingActivityRegistry, err := prb.ProcessingActivityRegistries.Get(ctx, id)
+		if err != nil {
+			panic(fmt.Errorf("cannot get processing activity registry: %w", err))
+		}
+		return types.NewProcessingActivityRegistry(processingActivityRegistry), nil
 	case coredata.SnapshotEntityType:
 		snapshot, err := prb.Snapshots.Get(ctx, id)
 		if err != nil {
@@ -3948,11 +4141,6 @@ func (r *queryResolver) Viewer(ctx context.Context) (*types.Viewer, error) {
 	}, nil
 }

-// TrustCenters is the resolver for the trustCenters field.
-func (r *queryResolver) TrustCenters(ctx context.Context, first *int, after *page.CursorKey, last *int, before *page.CursorKey, filter *types.TrustCenterFilter) (*types.TrustCenterConnection, error) {
-	return nil, fmt.Errorf("not implemented: TrustCenters - trustCenters")
-}
-
 // DownloadURL is the resolver for the downloadUrl field.
 func (r *reportResolver) DownloadURL(ctx context.Context, obj *types.Report) (*string, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -4822,6 +5010,16 @@ func (r *Resolver) PeopleConnection() schema.PeopleConnectionResolver {
 	return &peopleConnectionResolver{r}
 }

+// ProcessingActivityRegistry returns schema.ProcessingActivityRegistryResolver implementation.
+func (r *Resolver) ProcessingActivityRegistry() schema.ProcessingActivityRegistryResolver {
+	return &processingActivityRegistryResolver{r}
+}
+
+// ProcessingActivityRegistryConnection returns schema.ProcessingActivityRegistryConnectionResolver implementation.
+func (r *Resolver) ProcessingActivityRegistryConnection() schema.ProcessingActivityRegistryConnectionResolver {
+	return &processingActivityRegistryConnectionResolver{r}
+}
+
 // Query returns schema.QueryResolver implementation.
 func (r *Resolver) Query() schema.QueryResolver { return &queryResolver{r} }

@@ -4918,6 +5116,8 @@ type nonconformityRegistryResolver struct{ *Resolver }
 type nonconformityRegistryConnectionResolver struct{ *Resolver }
 type organizationResolver struct{ *Resolver }
 type peopleConnectionResolver struct{ *Resolver }
+type processingActivityRegistryResolver struct{ *Resolver }
+type processingActivityRegistryConnectionResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
 type reportResolver struct{ *Resolver }
 type riskResolver struct{ *Resolver }