Privacy & Data Protection
BetaRun your privacy programme under the data protection laws your organisation is subject to — fourteen law packs, from GDPR and UK GDPR to CCPA, PIPEDA and POPIA, on one engine.
Plan availability. Included on Pro, Business and Enterprise. It is not included on Starter.
- ✓Fourteen law packs on one engine; your country picks the default, and an admin can hold several laws at once
- ✓Applicability wizard, obligation register, readiness calendar and gap assessment
- ✓System and personal-data inventory, data flow map, lineage, and AI data discovery over files you upload
- ✓Processing-activity and purpose registers with change reviews
What it is.
The Privacy & Data Protection module is a working programme, not a questionnaire. Your organisation's country picks the law it starts with, and an admin can hold several at once: EU GDPR, UK GDPR, the California CCPA/CPRA, New York's SHIELD Act, the Delaware Personal Data Privacy Act, Canada's PIPEDA, Australia's Privacy Act, New Zealand's Privacy Act 2020, Singapore's PDPA, Hong Kong's PDPO, South Africa's POPIA, Kenya's Data Protection Act, Nigeria's NDPA and the DIFC Data Protection Law. Where no country is set, the module asks which law applies rather than guessing one. Screens use the law's own vocabulary, and neutral words where the laws you hold differ.
Every law pack is drafted: its content has not yet been verified against the official text by counsel, and the product says so on every screen that shows it. The DIFC pack carries short summaries and links only, because the DIFC's terms do not allow its text to be reproduced. Treat the module as a way to run and evidence your programme, not as legal advice — a status of compliant needs linked evidence and a person's approval, and is never computed from a score alone.
Three steps.
End to end.
Run the applicability wizard; the obligation register and readiness calendar follow from the laws you hold.
Systems, personal data, processing activities, purposes, notices, consent, processors and transfers — each a register you own.
Work individual rights requests and incidents against each law's own clocks, delete on schedule, and export audit packs with the evidence linked.
What you get.
- ✓Fourteen law packs on one engine; your country picks the default, and an admin can hold several laws at once
- ✓Applicability wizard, obligation register, readiness calendar and gap assessment
- ✓System and personal-data inventory, data flow map, lineage, and AI data discovery over files you upload
- ✓Processing-activity and purpose registers with change reviews
- ✓Notice builder with versions; consent records, withdrawals, and child and guardian consent
- ✓Individual rights requests and complaints, with a public request portal and each law's own response period
- ✓Breach response with each law's notification clocks, a notification workspace and corrective actions
- ✓Retention policies, legal holds and a deletion queue
- ✓Processor register with DPA review against each law's required clauses, processor obligations and reassessments
- ✓DPIA workbench, risk register, review schedule, and algorithm and AI reviews
- ✓Cross-border transfer register, data locations and transfer restrictions
- ✓Evidence, audit packs, a regulatory change monitor and a privacy copilot
- ✓Every pack marked drafted on screen — not yet verified against the official text by counsel
Quick answers.
Not from a score. A compliant status needs evidence linked and a person's approval. The law packs are drafted and not yet reviewed by counsel, so have counsel confirm your position before you rely on it.
The one your organisation's country points to — the UK GDPR for a UK organisation, the EU GDPR for Ireland, Germany or the Netherlands, the three US state packs for a US organisation, and so on. An admin can add or remove laws. With no country set, it asks rather than guessing.
No. Discovery reads files and documents you upload; there are no live database connectors.
Pro, Business and Enterprise. Starter does not include it.