A draft beside the version in force
Work in a draft while the current version still applies. Write in the editor's sections and subsections, or start with Import policy from document and tidy the formatting by hand afterwards.
Know who has signed off which version of the policy
By policy we mean the management-approved document your colleagues have to follow. In .legal, publishing a version and asking for sign-off are two separate acts, and each version keeps its own sign-off log, so you can see who signed off v1.0 and who is still missing on v2.0.
Unlimited users • Free onboarding and support • No commitment
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=34&height=26&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png){kind=small}
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=225&height=26&name=KAUFMANN%20(1).jpg){kind=small}
Policy sign-off
Meridian's security policy is on v2.0, and Anders can see who has signed off
Anders Krogh published version 2.0 of Meridian Nordic's information security policy on a Tuesday morning, and nothing happened. Nobody got an email, which was exactly the point, because the section on privileged access that came in with this version wasn't written for 850 colleagues. He opened the Recipients and sign-offs tab, chose v2.0, picked the group of contacts on the IT business area, added the two external consultants on the network project by name and email, and sent it. By Friday the sign-off progress on v2.0 showed most of the circle in, and two still outstanding.
-
Publishing made v2.0 the version in force and locked it, without telling anyone.
-
The round went to the IT group and two named consultants, and v1.0 keeps its own log.
-
The consultants signed off without a user account in the platform.
-
Anders chased the last two himself, with a reminder from the platform to each of them.
Policy sign-off
A PDF on the intranet can't tell you who read which version
Most security policies live as a file. The file gets replaced, the name picks up a v3-final at the end, and the record of who read what is an email thread.
-
The intranet copy is whatever was uploaded last, with no trace of what it replaced.
-
Nobody can say which version the network team actually read last spring.
-
Reading confirmations, if there are any, sit in someone's inbox rather than next to the version they belong to.
Policy sign-off
Publishing and sign-off are two separate acts
Publishing makes a draft the current version and locks it. Publishing doesn't notify anyone, and that's deliberate.
-
Sign-off is its own round, started from the Recipients and sign-offs tab, for the version you choose.
-
The round is optional for each version, so a corrected comma doesn't have to land in anybody's inbox.
-
Each version keeps its own sign-off log, so who signed off v1.0 and who is still missing on v2.0 are two separate answers.
Policy sign-off
You choose the version number, from the changes
Every published version carries a short description of what changed, and a person decides how big the change was.
-
An editorial change takes v1.0 to v1.1 and a substantive one takes it to v2.0. The call is yours, made from the diff.
-
Compare any two versions side by side or inline, no matter how far apart they are.
-
The approver is stored on each version, and the right to publish sits with that role.
Policy sign-off
A group, a colleague or a consultant
You choose who a version goes to for sign-off: a group, individual users, or external recipients by name and email. A group is the contacts grouped on a business area, so you can send to everyone in IT.
-
External recipients don't need a user account to receive the policy and sign off.
-
The recipient list is remembered, so the next version can go to the same recipients without building it again.
-
The same grouping is used when you send awareness material.
Policy sign-off
Anchored to controls, as lightly as suits you
A section or subsection can be linked to controls in the frameworks you've made active, and the link runs both ways.
-
Link section by section, put every relevant control in one closing section, or map from the framework side. All three work.
-
From a control you can see which policies it's anchored in, and which version.
-
The count of linked controls shows in the overview and on each version, so a gap is visible when the policy changes.
Policy sign-off
A tick is a confirmation, not a test
The recipient reads the policy and has to confirm they've read and understood it. That's what the log records, and here's what it doesn't.
-
The recipient sees the policy itself, with controls and recurring tasks stripped out.
-
If you need to know they understood it, that's a knowledge check, and it runs on the audit engine.
-
Nobody is chased on a schedule. A reminder goes from the platform to one person at a time, when somebody sends it.
Policy sign-off
Frameworks this covers
Two frameworks that expect the policy to exist, and a policy that can point back at their controls.
-
ISO 27001
Read about ISO 27001ISO 27001 expects documented policies. Once the framework is active, a policy section can be linked to its controls, and from each control you can see which policies are linked to it.
-
NIS2
Read about NIS2NIS2 expects documented security policies as well. With NIS2 active, policy sections link to its controls the same way, alongside ISO 27001 if you run both.
Our Customers
+400
companies
+11.000
users
+79.000
contracts
+14.000
processing activities
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
Use cases
Book demo
Find the job you need done
Every use case is a real piece of compliance work, told the way it actually runs in the platform. Filter by who you are, what you work with, and which frameworks you answer to.
Compliance & GRC leadCISO & IT securityDPOLegal counselExecutive & board
Energy & utilitiesFinancial servicesManufacturingPublic sectorHealthcareProfessional servicesRetail & e-commerceTechnology
SMVMid-marketEnterprise & group
GDPRNIS2ISO 27001CIS18DORAePrivacyAI ActD-mærketData Act
Compliance & GRC lead
Run awareness training that reaches every colleague
Send out training and policies, chase the stragglers automatically, and prove every colleague completed it. You bring the material, we run the rails.
See awareness training
CISO & IT security
Run your ISMS in one platform
The frameworks you answer to, the controls beneath them and the documentation that proves the work happened, all three in one module, with status updating itself from completed tasks.
See how the ISMS runs
CISO & IT security
Achieve and maintain ISO 27001 certification
The certificate is won at the audit and kept alive in the years between. Work the controls under the standard's own numbering and plan the whole cycle in one pass.
See the certification route
Compliance & GRC lead
Hand over everything a colleague was responsible for
Somebody leaves and their name is still on contracts, processing activities, assets and the tasks that document your controls. One table lists every place they are named as responsible, and you hand each role to the colleague who should have it.
See the handover
Compliance & GRC lead
Manage compliance across a group of companies
Run every company in the group from one platform, document once at group level, and still report entity by entity. Delivered by the Group Companies add-on.
See group compliance
Legal counsel
Run due diligence on your vendors
Classify a vendor on your own criteria, get the answers and documents you need with no login for them, and move the approved ones straight into contracts.
See vendor due diligence
Compliance & GRC lead
Multi-framework compliance: do the work once
Do a control once and it counts across every framework it maps to, with a simulated score on the ones you haven't started yet.
See multi-framework compliance
CISO & IT security
Get NIS2-ready without starting from scratch
Build on the ISO 27001 work you've already done, switch NIS2 on, and let a simulated score show how far ahead you already are.
See NIS2 readiness
DPO
From twelve spreadsheets to one record of processing
Your GDPR documentation already exists, it just lives in spreadsheets. Export what you have and we structure it in .legal for you, typically inside two weeks.
See the move off spreadsheets
Compliance & GRC lead
Build one risk register for the whole organisation
One register across GDPR, NIS2, AI and information security, where each risk area keeps its own matrix, scale and appetite. Delivered by the Enterprise Risk Management add-on.
See the risk register
Executive & board
Give the board a risk picture it can act on
One management report across every risk area: entities assessed, risks above appetite, exposure now and once the open plans are done. Export it with your own comment on it.
See board risk reporting
DPO
Keep your records of processing always audit-ready
The Article 30 record is a report drawn from your processing activities, not a document you rebuild before an inspection. Correct an activity and the record says so immediately.
See the record stay current
Compliance & GRC lead
Get ready for the D-seal
D-Seal's own criteria sit in the platform under a formal agreement with D-Seal, mapped 1:1 with the level 3 criteria. Work the controls, collect the documentation, export it per task.
See the D-seal route
Legal counsel
Contract management with obligations and renewals
Register what each contract obliges you to do, delegate it as tasks with deadlines, and see in one overview that it gets done on time. Renewals notify ahead of the date.
See obligations and renewals
CISO & IT security
One incident log for GDPR and NIS2
A personal data breach and a security incident go in the same register, on the same form. Record it, attach the documentation, delegate the follow-up, and export it when somebody asks.
See the incident log
CISO & IT security
Secure the supplier chain NIS2 holds you responsible for
Register the supplier, classify it on criteria you set yourself, get the answers and documents out of it without a login, then assess it as a risk in your NIS2 risk area.
See the supplier chain end to end
DPO
Every data processing agreement, and the ones that are missing
Put every data processor next to its agreement and the gaps stop hiding. Register the agreement once, reference it from everything that relies on it, and change it in one place.
See the agreements and the gaps
Legal counsel
Put AI to work on your contract portfolio
Three jobs AI does on contracts today: it fills the register from the document you already have, checks a contract against your own best practice, and answers questions across the portfolio. All of it in beta.
See AI on the contract portfolio
CISO & IT security
Catch the risk when somebody notices it
One public link with no login, so a colleague can report what they spotted from a phone in half a minute. It lands in an inbox with an owner, where a person decides whether it becomes a risk scenario.
See how an observation lands
DPO
Run your DPIAs where the processing activity already lives
Run a DPIA as an internal assessment on the same audit engine you already send questionnaires with. You write the questions yourself, and when the answers come back you relate them to the processing activity they concern.
See DPIAs on the activity
CISO & IT security
Put a number on the risk, and on what it costs to fix
Exposure before a mitigation plan, exposure after it, and what the plan costs. Compare competing plans on figures you supply yourself, in order of magnitude and direction rather than two decimal places.
See the numbers behind the plans
DPO
Map your personal data to the systems that hold it
Start from the system and see which personal data sits in it, gathered from every processing activity it's attached to. Nothing is scanned for you.
See the system's personal data
No use cases match that combination yet. Try removing a filter.