A summary on every system
Every system shows the personal data in it, gathered from all the processing activities it's attached to, so the question can start with the system rather than with each activity.
Map your personal data to the systems that hold it
Open a system and see which personal data sits in it, gathered from every processing activity it's attached to, with a summary on the vendor behind it as well. Nothing is discovered for you: every entry is one a colleague registered, which is why you can stand behind it.
Unlimited users • Free onboarding and support • No commitment
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=34&height=26&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png){kind=small}
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=225&height=26&name=KAUFMANN%20(1).jpg){kind=small}
Data mapping
Before the old customer portal is switched off, Sofie already knows what's in it
When IT announced that Meridian's old customer portal would be switched off in the spring, the first question landed with Sofie Bruhn, as it always does: what personal data is actually in it, and what depends on it? She used to answer that by reading processing activities one at a time and hoping the list was complete. This time she opened the portal itself. It showed the personal data gathered from every activity it was attached to and which activities those were, and the vendor behind it showed the summary too. Anders Krogh, who owns the asset register on the security side, was looking at the same system.
-
The answer starts from the system, so nobody has to piece it together from the activities by hand.
-
The processing activities the portal serves are listed on it, as far as her access reaches, with each one's responsible person and business area.
-
Which group companies use the portal is recorded on each activity, not guessed at group level.
-
Retiring it is still manual work, but the list of activities to change is already in front of her, as long as she has access to all of them.
Data mapping
The question is about a system, and the record is about activities
Auditors, IT and customers rarely ask about a processing activity. They ask about a system, and when the documentation is built around activities, that's a slow question to answer.
-
The answer is scattered across every activity that happens to use the system.
-
A list kept by hand on the side drifts from the record the first time somebody forgets it exists.
-
Nobody can say for sure that the list is complete, which is the one thing the person asking wants to know.
Data mapping
Open the system, and read what's in it
Activities, systems and vendors are mapped to each other, and the record page tells that side of it. This page starts at the other end, with the system.
-
Every activity that uses the system adds its share, and the system shows the personal data gathered from all of them.
-
The vendor behind it shows the summary too, so the question can start there as well.
-
A tab on the system lists those activities with their responsible person, risk score and business area, showing only the ones you have access to.
Data mapping
A system can only hold what the purpose covers
When you attach a system to a processing activity, you pick its personal data from what that activity already covers. Nothing else is on offer.
-
The list you pick from is the activity's own categories, so a system can't be mapped to data the purpose doesn't cover.
-
From that list you take only what the system actually holds. Meridian's customer system gets the ordinary contact details, while trade union membership and national ID numbers stay off it.
-
On the same attachment you mark which group companies use the system, even when the activity applies to several of them.
Data mapping
Category level is enough, until somebody asks for more
Personal data categories are the general level. Beneath them you can add your own personal data types (name, email address or physical address, for instance) when the questions you get need that detail.
-
The types are yours. You create them in your master data and map them to the categories you already use.
-
They attach on the processing activity, the system and the processor, so you can record the detail where it's processed and stored.
-
It's optional, and nothing is lost by staying at category level. Use them where the detail earns its keep and leave them out elsewhere.
Data mapping
The same register serves the DPO and the CISO
Assets are no longer only systems that process personal data. Anders Krogh documents Meridian's IT and OT in the same register Sofie maps against, and personal data is one way of describing an asset rather than the definition of one.
-
One register, so the same system isn't documented twice by two teams keeping two lists.
-
With Enterprise Risk Management, part of the Enterprise plan, a relationship graph lets you follow a processing activity out to the systems and vendors it depends on, and see why a risk can be inherited from further along.
-
The graph draws on the connections you've mapped, which is what makes doing the mapping properly worth it.
Data mapping
Every entry is registered by a person, on purpose
Mapping is the clearest place to see where .legal stops. We build the plan, not the filling-in.
-
Nothing scans, crawls or connects to your systems to find personal data. Every entry in your mapping was registered by a person.
-
Replacing a system is manual today: create the new asset, find the activities the old one was used in, remove it on each and add the new one.
-
There's no bulk import of your system list we can point you to. Getting existing documentation in at the start is a separate conversation.
Data mapping
Frameworks this covers
GDPR, read from the systems that carry it.
-
GDPR
Learn about GDPRYour record of processing is GDPR work, and the systems behind it are usually where the questions start. This is the same documentation, read from the system's end.
Our Customers
+400
companies
+11.000
users
+79.000
contracts
+14.000
processing activities
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
Use cases
Book demo
Find the job you need done
Every use case is a real piece of compliance work, told the way it actually runs in the platform. Filter by who you are, what you work with, and which frameworks you answer to.
Compliance & GRC leadCISO & IT securityDPOLegal counselExecutive & board
Energy & utilitiesFinancial servicesManufacturingPublic sectorHealthcareProfessional servicesRetail & e-commerceTechnology
SMVMid-marketEnterprise & group
GDPRNIS2ISO 27001CIS18DORAePrivacyAI ActD-mærketData Act
DPO
Keep your records of processing always audit-ready
The Article 30 record is a report drawn from your processing activities, not a document you rebuild before an inspection. Correct an activity and the record says so immediately.
See the record stay current
DPO
Every data processing agreement, and the ones that are missing
Put every data processor next to its agreement and the gaps stop hiding. Register the agreement once, reference it from everything that relies on it, and change it in one place.
See the agreements and the gaps
Compliance & GRC lead
Build one risk register for the whole organisation
One register across GDPR, NIS2, AI and information security, where each risk area keeps its own matrix, scale and appetite. Delivered by the Enterprise Risk Management add-on.
See the risk register
Compliance & GRC lead
Manage compliance across a group of companies
Run every company in the group from one platform, document once at group level, and still report entity by entity. Delivered by the Group Companies add-on.
See group compliance
DPO
From twelve spreadsheets to one record of processing
Your GDPR documentation already exists, it just lives in spreadsheets. Export what you have and we structure it in .legal for you, typically inside two weeks.
See the move off spreadsheets
DPO
Run your DPIAs where the processing activity already lives
Run a DPIA as an internal assessment on the same audit engine you already send questionnaires with. You write the questions yourself, and when the answers come back you relate them to the processing activity they concern.
See DPIAs on the activity
Compliance & GRC lead
Run awareness training that reaches every colleague
Send out training and policies, chase the stragglers automatically, and prove every colleague completed it. You bring the material, we run the rails.
See awareness training
Legal counsel
Run due diligence on your vendors
Classify a vendor on your own criteria, get the answers and documents you need with no login for them, and move the approved ones straight into contracts.
See vendor due diligence
Compliance & GRC lead
Multi-framework compliance: do the work once
Do a control once and it counts across every framework it maps to, with a simulated score on the ones you haven't started yet.
See multi-framework compliance
CISO & IT security
Get NIS2-ready without starting from scratch
Build on the ISO 27001 work you've already done, switch NIS2 on, and let a simulated score show how far ahead you already are.
See NIS2 readiness
Executive & board
Give the board a risk picture it can act on
One management report across every risk area: entities assessed, risks above appetite, exposure now and once the open plans are done. Export it with your own comment on it.
See board risk reporting
CISO & IT security
Run your ISMS in one platform
The frameworks you answer to, the controls beneath them and the documentation that proves the work happened, all three in one module, with status updating itself from completed tasks.
See how the ISMS runs
Compliance & GRC lead
Get ready for the D-seal
D-Seal's own criteria sit in the platform under a formal agreement with D-Seal, mapped 1:1 with the level 3 criteria. Work the controls, collect the documentation, export it per task.
See the D-seal route
Legal counsel
Contract management with obligations and renewals
Register what each contract obliges you to do, delegate it as tasks with deadlines, and see in one overview that it gets done on time. Renewals notify ahead of the date.
See obligations and renewals
CISO & IT security
Achieve and maintain ISO 27001 certification
The certificate is won at the audit and kept alive in the years between. Work the controls under the standard's own numbering and plan the whole cycle in one pass.
See the certification route
CISO & IT security
One incident log for GDPR and NIS2
A personal data breach and a security incident go in the same register, on the same form. Record it, attach the documentation, delegate the follow-up, and export it when somebody asks.
See the incident log
CISO & IT security
Secure the supplier chain NIS2 holds you responsible for
Register the supplier, classify it on criteria you set yourself, get the answers and documents out of it without a login, then assess it as a risk in your NIS2 risk area.
See the supplier chain end to end
Legal counsel
Put AI to work on your contract portfolio
Three jobs AI does on contracts today: it fills the register from the document you already have, checks a contract against your own best practice, and answers questions across the portfolio. All of it in beta.
See AI on the contract portfolio
Compliance & GRC lead
Hand over everything a colleague was responsible for
Somebody leaves and their name is still on contracts, processing activities, assets and the tasks that document your controls. One table lists every place they are named as responsible, and you hand each role to the colleague who should have it.
See the handover
CISO & IT security
Catch the risk when somebody notices it
One public link with no login, so a colleague can report what they spotted from a phone in half a minute. It lands in an inbox with an owner, where a person decides whether it becomes a risk scenario.
See how an observation lands
CISO & IT security
Put a number on the risk, and on what it costs to fix
Exposure before a mitigation plan, exposure after it, and what the plan costs. Compare competing plans on figures you supply yourself, in order of magnitude and direction rather than two decimal places.
See the numbers behind the plans
CISO & IT security
Know who has signed off which version of the policy
Publish a policy version, then ask for sign-off as a separate step. Each version keeps its own log of who has signed off and who is still missing.
See sign-off per version
No use cases match that combination yet. Try removing a filter.