All features

Central overview of all vendors processing personal data. Art. 28(1) requires you to only use processors providing sufficient guarantees — which starts with knowing who your processors are.

• Type, criticality and processor role per vendor
• CSV bulk import and export
• Offboarding workflow with checklist
• Contact details and contract periods

Generate data processing agreements meeting all Art. 28 requirements.

• Templates with all 12 mandatory Art. 28 provisions
• Digital signing by both parties
• Automatic PDF generation
• Wet signature option for special category data (Art. 9)

Automatically generated register compliant with Art. 30 GDPR.

• Auto-populated from signed agreements
• Retention periods, recipient categories and security measures
• DPO contact details and employee count indicator
• Internal processing activities (no external processor)
• PDF export for auditors

Record, assess and report data breaches per Art. 33-34.

• Risk categorisation (auto-detection of special categories)
• 72-hour deadline tracking with reminders
• Notification to DPA and to data subjects
• Internal breach register for documentation

Manage data subject requests with deadlines and status tracking.

• Access, rectification, erasure, portability
• Automatic deadline calculation (1 month)
• Status workflow: received, in progress, completed, rejected
• Automatic notification to processor

Data Protection Impact Assessments with risk matrix and approval workflow.

• Risk matrix with likelihood x impact scoring
• Draft, review, approval, rejection workflow
• Automatic link to processing register
• Art. 36 prior consultation workflow

Manage sub-processor changes and objection periods.

• Vendor portal: vendor can submit sub-processors directly
• Approval/objection workflow per sub-processor
• Automatic objection deadline enforcement
• Notification to vendor upon decision

Document international transfers per Art. 46-47.

• SCCs, adequacy decisions, BCRs as legal basis
• Transfer Impact Assessment (TIA) workflow
• Automatic expiry date tracking
• Compliance check for Schrems II requirements

Automatic reminders for contract renewals and certificates. The accountability principle (Art. 5(2)) requires ongoing compliance — not just when signing an agreement, but throughout its duration.

• Automatic email reminders for approaching deadlines
• Periodic assessment cycles per vendor
• Dashboard overview of upcoming renewals

Store certificates and reports securely with expiry alerts. Art. 5(2) and Art. 24 require you to demonstrate that processing complies with the GDPR. Art. 28(3)(h) obliges the processor to make all information available for audits.

• ISO 27001, SOC 2, pentest reports, policies
• Automatic expiry notifications
• Confidentiality levels per document

Send security questionnaires to vendors via a portal. Art. 28(1) requires processors to provide "sufficient guarantees" of appropriate measures — questionnaires are a recognised way to assess these guarantees.

• Standard security questionnaire
• Vendor fills in via magic link (no account needed)
• Automatic scoring (green/yellow/red)
• Notification to managers upon completion

Automatic risk score per vendor. Art. 24(1) requires measures proportionate to the risk of processing. Art. 32 prescribes a risk-based approach to security. Compliance scoring makes this concrete and measurable.

• Score based on DPA, certificates, questionnaire, sub-processors and breaches
• Status: compliant, at risk, non-compliant
• Action list per vendor with direct links
• EEA transfer check and TIA status

Export a complete audit pack with all documentation. The accountability principle (Art. 5(2) and Art. 24) requires you to demonstrate at any time that your processing complies with the GDPR.

• Vendors, DPAs and evidence as CSV
• ZIP export with all documents
• Processing register as PDF