Regulatory Authority Correspondence UI in Figma

Quick answer

Regulatory correspondence UI stores every breach filing, authority reply, and amendment as an immutable thread—not scattered PDFs in legal’s drive. Design a filing archive linked to incidents, authority thread view (outbound filings + inbound requests), amendment and phased notification tracker, and audit-ready export bundles. Connect to breach notification, subprocessor breach, compliance exports, and forensic evidence. Start from the Figma guides hub and pair with privacy triage, trust center, and Dev Mode handoff.

Who this is for

Product designers building privacy ops tooling for legal and DPO teams post-filing.
Legal and privacy counsel managing multi-jurisdiction authority threads over months.
Compliance auditors who need immutable filing history tied to incidents and evidence.

Filing archive hub (admin overview)

RegulatoryFilingArchive — Acme App · 847 filings · 12 open authority threads
├── Header: Draft 2 · Submitted 30d: 8 · Awaiting response 5 · Amendment required 3 · Closed 30d: 11
├── Actions: [ New filing ] [ Link existing incident ] [ Export audit bundle ] [ Authority directory ]
├── Tabs: All filings · Breach notifications · DSAR escalations · Inquiry responses · Amendments · Closed
├── Sort: Submitted date · Authority · Incident · Status · Jurisdiction
├── Row example:
│   FIL-882 · EU lead SA · Breach · PIN-1044 / VIN-992 · Submitted 2026-08-18 · Ref SA-2026-4419 · Awaiting response
│   FIL-881 · UK ICO · Breach amendment · VIN-992 · Submitted 2026-08-20 · Amendment v2 · Closed
│   FIL-880 · CNIL · Inquiry · Regulator mail 2026-08-10 · Due 2026-08-25 · Draft
└── Link: [Breach notification](/designing-breach-notification-and-regulatory-reporting-ui-in-figma/) · [Compliance exports](/designing-compliance-exports-and-legal-hold-ui-in-figma/) · [Audit log](/designing-audit-log-and-security-activity-ui-in-figma/)

Column / element	Purpose
Filing ID	Immutable FIL-* reference
Authority	Lead SA, ICO, state AG, etc.
Linked incident	PIN-, VIN-, or internal IR id
Reference number	Authority-assigned after submit
Version	Initial · Amendment v2 · Final scope

Verdict: Filing archive fails when submitted PDFs cannot be found six months later—every outbound document gets a FIL-* record at draft time.

Authority directory and jurisdiction mapping

AuthorityDirectory — Config · 23 authorities tracked
├── EU lead SA: Irish DPC · Mapping rule: EU establishment Ireland · Contact portal URL
├── UK: ICO · Post-Brexit separate from EU lead
├── US states: CA AG · NY DFS (if applicable) · Threshold rules per state
├── Enterprise: Customer-specific DPAs may require notify customer DPO first
├── Fields per authority: Name · Portal/email · Language · Deadline rules · Reference format
├── Auto-suggest: From [cascade impact](/designing-subprocessor-breach-notification-and-cascade-impact-ui-in-figma/) region breakdown
└── Link: [Cross-border transfer](/designing-cross-border-data-transfer-and-scc-management-ui-in-figma/) · [DPA hub](/designing-data-processing-agreements-and-subprocessor-management-ui-in-figma/)

Design jurisdiction pickers that pre-fill from incident data—not free-text authority names.

Breach filing composer (outbound)

BreachFilingComposer — FIL-882 · Draft · Linked: VIN-992 · EU lead SA
├── Pre-fill source: [Cascade worksheet](/designing-subprocessor-breach-notification-and-cascade-impact-ui-in-figma/) · [Regulator tracker](/designing-breach-notification-and-regulatory-reporting-ui-in-figma/)
├── Required fields (GDPR Art. 33 style):
│   ├── Nature of breach · Categories of data · Approximate numbers
│   ├── Likely consequences · Measures taken · DPO contact
│   └── Awareness timestamp: 2026-08-16 02:14 UTC · Deadline: 2026-08-19 02:14 UTC
├── Attachments: Vendor partial report · Internal timeline · [Chain of custody](/designing-forensic-evidence-management-and-chain-of-custody-ui-in-figma/) index
├── Phased notification toggle:
│   ├── ☐ Initial filing with incomplete scope (Art. 33(4))
│   └── Auto-create amendment task FIL-882-AMD-1 · Due when vendor final report received
├── Approval chain: DPO ☐ · Legal ✓ · External counsel ☐
├── Submit: Portal upload simulation · PDF snapshot · submitted_at immutable
└── Post-submit: Reference number field · Status → Submitted · Notify [war room](/designing-security-operations-shift-handover-and-war-room-ui-in-figma/) thread

Snapshot at submit—edits after submission create a new amendment version, never overwrite FIL-882 v1.

Authority thread view (bidirectional)

AuthorityThread — FIL-882 · Irish DPC · Status: Awaiting response
├── Timeline (newest first):
│   2026-08-18 14:02 · OUT · Initial breach notification · FIL-882 v1 · Ref pending
│   2026-08-19 09:15 · IN · Authority acknowledgment · Ref SA-2026-4419 · PDF attached
│   2026-08-22 11:00 · IN · Request for additional information · Due 2026-09-05
│   2026-08-23 16:30 · OUT · Response to RFI · FIL-882-RFI-1 · Linked evidence bundle
│   2026-08-25 10:00 · OUT · Amendment v2 · Updated scope 102k records · FIL-882-AMD-1
├── Inbound message intake:
│   ├── Upload authority PDF/email · OCR optional · Parse reference number
│   ├── Classify: Acknowledgment · RFI · Decision · Fine notice · Close
│   └── Create task: Assign legal · Due date from authority letter
├── Outbound from thread: [ Reply to RFI ] [ Submit amendment ] [ Request extension ]
└── Link: [Privacy triage](/designing-privacy-incident-severity-classification-and-triage-ui-in-figma/) if new incident spawned from RFI

Threads are the system of record for back-and-forth—not email alone.

Amendment and phased notification tracker

Amendment type	When used	UI requirements
Phased initial	72h deadline, scope unknown	Flag incomplete fields · Auto AMD task
Scope update	Vendor final report changes numbers	Diff view v1 vs v2 · Reason required
Corrective	Error in original filing	Legal approval · Linked to audit log
Final closure	Authority satisfied · Incident closed	Link PIR

AmendmentTracker — VIN-992 · 2 amendments · 0 overdue
├── FIL-882 v1 · Initial · 98k records · Submitted 2026-08-18
├── FIL-882-AMD-1 · Scope update · 102k records · Submitted 2026-08-25 · Trigger: Vendor report received
├── FIL-882-RFI-1 · Response only · Not an amendment · Attached to thread
├── Deadline widgets: RFI due 2026-09-05 · 11 days remaining
└── Export: Single PDF bundle v1 + AMD-1 + RFI-1 for [compliance audit](/designing-compliance-audit-evidence-and-certification-renewal-ui-in-figma/)

Show version diff for record counts and data categories—auditors ask what changed between v1 and v2.

Audit export bundle

AuditExportBundle — Incident VIN-992 · Generated 2026-08-26
├── Contents checklist:
│   ├── ☐ All FIL-* submissions with timestamps and reference numbers
│   ├── ☐ Authority inbound PDFs with classification tags
│   ├── ☐ Linked [forensic evidence](/designing-forensic-evidence-management-and-chain-of-custody-ui-in-figma/) manifest
│   ├── ☐ [Cascade worksheet](/designing-subprocessor-breach-notification-and-cascade-impact-ui-in-figma/) snapshot at each filing version
│   ├── ☐ Approval chain signatures · DPO/legal names and times
│   └── ☐ [Customer notification](/designing-subprocessor-breach-notification-and-cascade-impact-ui-in-figma/) send log (separate section)
├── Format: ZIP · Indexed PDF · JSON metadata for [compliance export](/designing-compliance-exports-and-legal-hold-ui-in-figma/)
├── Legal hold: ☐ Apply hold on bundle · Prevents auto-deletion per [retention policy](/designing-data-retention-policies-and-auto-deletion-ui-in-figma/)
└── Access log: Who downloaded · When · IP · Required for SOC2 evidence

One-click export saves weeks of audit prep—design it early, not as an afterthought.

Comparison: filing archive vs adjacent tools

Tool	Focus	This UI adds
Breach notification	Compose and submit first filing	Long-term thread + amendments
Subprocessor breach	Vendor incident cascade	Links VIN-* to FIL-* archive
Compliance exports	Broad audit packages	Filing-specific bundle template
Trust center	Public documentation	Never expose draft filings publicly
Forensic evidence	Evidence chain	Attach manifest to each FIL version

Handoff checklist (Dev Mode)

RegulatoryFiling — filing_id, incident_id, authority_id, jurisdiction, filing_type, version, status, submitted_at, reference_number.
FilingSnapshot — filing_id, version, payload_json, pdf_url, submitted_at, submitted_by, immutable_hash.
AuthorityMessage — thread_id, direction (in/out), message_type, received_at, due_at, attachment_urls, parsed_reference.
AmendmentTask — parent_filing_id, amendment_filing_id, reason, trigger_event, due_at, completed_at.
FilingApproval — filing_id, approver_role, approver_id, approved_at, comment.
AuditExport — export_id, incident_id, filing_ids[], generated_at, downloaded_by[], legal_hold_applied.
Accessibility — Timeline keyboard navigable; version diff readable in screen reader order; deadline announcements.

Common mistakes

Mistake	Why it hurts	Fix
Overwrite submitted filing	Audit failure	Immutable versions · AMD creates new FIL row
Authority mail stays in inbox	Lost RFI deadlines	Inbound intake creates threaded tasks
No reference number field	Cannot correlate replies	Required after acknowledgment parsed
Draft visible in trust center	Legal exposure	Strict internal-only until published summary
Missing phased notification UI	Late or incomplete first filing	Art. 33(4) toggle + AMD auto-task
Export manual every audit	Expensive	One-click bundle from FIL-* index
No link to incident	Orphan filings	Mandatory PIN-/VIN-* link at create
Ignore amendment diffs	Auditor confusion	Side-by-side scope and count changes

Recommended workflow

Create FIL- draft* when breach notification composer reaches “ready to submit”—not after the fact.
Snapshot and submit with approval chain; store reference number on acknowledgment.
Intake authority inbound into the same thread with classification and due dates.
Track amendments as separate versions with diff and trigger reason.
Generate audit bundle at incident close for compliance evidence.
Apply legal hold when retention policy would otherwise delete filing artifacts in Dev Mode.

FAQ

Public vs internal filing UI?

All draft and authority thread detail is internal. Public summaries belong on trust center or status page—never raw FIL payloads.

Multiple authorities per incident?

One thread per authority; hub view groups by incident (VIN-992 → FIL-882 EU, FIL-881 UK).

DSAR escalations to regulator?

Support filing_type DSAR_escalation and Inquiry_response—same thread pattern, different templates.

Link from privacy triage?

Regulator-sourced incidents auto-create Inquiry thread with High default tier and RFI due date from parsed letter.

Reuse breach composer fields?

Share field components with breach notification UI—archive adds version history and inbound parsing.

Next steps

Design breach notification and regulatory reporting UI in Figma — initial filing composer shared with archive
Design subprocessor breach notification and cascade impact UI in Figma — incident source for vendor breach filings
Design privacy incident severity classification and triage UI in Figma — upstream intake for regulator inquiries
Design compliance exports and legal hold UI in Figma — broader audit packages including filing bundles
Design compliance audit evidence and certification renewal UI in Figma — annual audit use of filing archive exports

Designing regulatory authority correspondence and breach filing archive UI in Figma: filings, threads, and immutable records