Skip to main content
GDPR Compliance Suite

Setting up GDPR Compliance Suite in Odoo: settings, states and your first week

To set up GDPR Compliance Suite, start with the controller fields (company, DPO contact, supervisory authority), the alert recipients and the warning days; then review the legal bases and add your processing activities. Before real cases come in, learn the states each record goes through. In the first week, check activities, breaches, draft DPIAs, review records and flagged portal users.

FlexigoTech · Editor in charge: Víctor Gómez · Updated 4 November 2026

Key facts

Versions
Odoo 17, 18, 19 and 20
Checked
in the module's source code, version 20.0 · against the sources linked at the end
Reading time
5 min

Before installing: version and licence

This list follows the order you would use in a real implementation. If you are still weighing up whether the module suits you, start with what it covers and what you need before installing it.

  • Check your Odoo version: the module is published on Odoo Apps for 17.0, 18.0, 19.0 and 20.0.
  • Be clear on cost: €9 per Odoo version, one-off payment, excluding VAT, for 17, 18, 19 and 20. It is a module with a FlexigoTech Cloud local service, which costs €29/month or €290/year excluding VAT (Pro: €58/month or €580/year).
  • Decide where to buy if you plan to upgrade: with the subscription, the module for new Odoo versions is included if you bought it on flexigotech.com; on the Odoo App Store, each Odoo version is bought there. See the Odoo Apps listing and the module page.
  • Bear in mind that without a subscription, or with the service suspended, whatever the subscription provides stops; your data stays in your Odoo.

Controller settings: who you are and who gets alerts

These are the module's fields that identify the company and the DPO and set up the alerts.

Company and DPO details

  • Company: the company these details belong to.
  • DPO Partner Record: the DPO's contact record.
  • DPO / Responsible Contact Name, DPO Email and DPO Phone: contact name, email and phone.
  • Formal DPO Designated: the tick box showing whether a DPO has been formally designated.
  • AEPD DPO Registry Reference (Spain): the AEPD registry reference, a field its label reserves for Spain.
  • Primary Supervisory Authority: the main supervisory authority.

Alerts and warning days

  • Breach Alert Recipients: who receives breach alerts. It accepts several.
  • DSAR Overdue Alert Recipients: who receives alerts for overdue DSARs. It also accepts several.
  • Retention Advance Warning (days): how many days in advance the retention warning comes, as a whole number.
  • DSAR Reminder Days Before Deadline: the number of days before the deadline for the DSAR reminder.

Control tick boxes

  • Art. 30(5) SME Exception Note Acknowledged: the tick box with that label about the SME exception note.
  • Encryption Key Configured: the tick box showing whether the encryption key is configured.

Before moving on, look at what these tick boxes show in your database and talk it through with your DPO or adviser.

First records: legal bases and processing activities

  • Open GDPR Toolkit › Legal Bases and go through the list: each basis has an article reference, legal basis, type and a requirement tick box.
List of GDPR legal bases with article reference, legal basis, type and requirement tick box
The legal bases list in GDPR Toolkit, with sixteen records; only Legitimate Interests has the requirement box ticked.
  • Add your activities under GDPR Toolkit › Processing Activities (RoPA).
List of processing activities with the Active filter and three records for payroll, customer orders and web analytics
Processing activities with the Active filter and the company My Company (San Francisco): all three as controller, in Active state and with DPIA unticked.
  • Check the activities view filtered by DPIA required, to see which activities have that box ticked.
List of processing activities filtered by DPIA required with one marketing record
The view filtered by DPIA required, with a single marketing record as controller, the DPIA box ticked and the company My Company (San Francisco).

The states each record goes through

The module defines several state flows. Go through them with whoever will use it before the first real case arrives. If you want to see how menus and records fit together, we cover it in how GDPR Compliance Suite works.

Draft, Active and Archived

One of the flows goes through Draft, Active and Archived. In the activities list shown in the screenshots, the records are in Active.

From New to Closed

Another flow runs through New, Under Assessment, DPA Notified, Data Subjects Notified and Closed. The breach register shows rows in New and in Under Assessment.

Flow with DPO review

Another flow goes through Draft and Submitted for DPO Review and ends in Approved or Rejected.

Flow that starts at Received

This flow moves through Received, In Review, Identity Verified and Response Drafted, and has four different closing states, with the technical codes closed_completed, closed_refused, closed_extended and closed_partial_erasure.

Two-step flows

There are two short flows with the codes draft and done: one goes from Configure to Export Ready and the other from Configure to Ready.

  • Explain to each user which states they will handle in their work.
  • Agree which closing state is used in each case of the flow that starts at Received.

Your first week: what to check

Walkthrough of the activities, breaches, active incidents and DPIA lists in GDPR Toolkit
From the activities list with the Active filter to the breach register, the active incidents list and the DPIA list with one draft record.
  • In the activities list with the Active filter, check the reference, name, type, state, DPIA required, retention and company of each record.
  • In the breach register, check dates, DPA notification deadline and state on each row.
  • In the active incidents list, look at the risk level and state of each breach.
  • In the DPIA list, find the ones still in draft and review their residual risk and approval columns.
  • In the review records, check that each one has Processing Activity, Company, Review Date, Reviewer and Action Taken, and use Extension Justification, New Retention End Date and Notes where needed.
  • Check for portal users with Portal Abuse Flag (gdpr_portal_flagged): according to its description, it is set when a portal user exceeds the sustained-abuse threshold.
  • Go back to the settings and confirm that Breach Alert Recipients and DSAR Overdue Alert Recipients point to the right people.

If a message you do not understand appears during these days, see the module's messages explained one by one.

How FlexigoTech can help

At FlexigoTech we implement Odoo 17, 18, 19 and 20 and build bespoke connectors and integrations. If you would like us to set up these fields with your team or connect the module to other systems, get in touch through the module page.

Keep reading

How GDPR Compliance Suite works in Odoo: a glossary of menus, lists and actionsThe menus, scheduled actions and lists of GDPR Compliance Suite for Odoo 17, 18, 19 and 20, explained as a glossary: what each section is called and where.GDPR Compliance Suite errors in Odoo: when they appear and what to do about each oneThe error messages of GDPR Compliance Suite for Odoo, quoted word for word: when each one appears, what it means and what to do, walked through an example.GDPR Compliance Suite for Odoo: what it covers, what it doesn't and whether it fitsWhat GDPR Compliance Suite covers according to its documentation, what it won't decide for you, what to have ready and which Odoo versions it is published for.
Checked in the module's source code (version 20.0) and the linked sources

Sources