The record as a report view
A read-only, spreadsheet-like view drawn from your processing activities. You edit the activity, never the record, so the record and its source can never disagree.
Keep your records of processing always audit-ready
The record of processing is a report drawn from your processing activities, not a document you rebuild before an inspection. Correct an activity and the record says so immediately, with red markers on whatever is still missing.
Unlimited users • Free onboarding and support • No commitment
.jpeg)
.jpg)
.jpg)
.jpg)
-1.png)
.jpeg)
.jpg)
Always audit-ready Meridian's record is ready on a Tuesday, not after a fortnight of tidying
Sofie Bruhn is group DPO at Meridian Nordic, three legal entities and around 1,200 vendors between them. Her record of processing used to be true on the day it was written and slightly less true every week after that, and she found out how much less every time a customer sent an audit questionnaire. Now the record is a report drawn from the processing activities themselves. She edits the activity, the record says so immediately, and the red markers tell her where it has gone thin before anyone else asks.
-
The record is drawn per legal entity, with that company's own details on the export.
-
A correction on a processing activity is in the record straight away, with no save step.
-
Red markers point at exactly the fields that are missing, per activity and in total.
-
Every action on an activity is in a change log, so three people can work in it safely.
Always audit-ready A record is only true until something changes
Documentation goes out of date quietly. The activity was described correctly, and then payroll moved to a new provider and nobody thought to mention it to the DPO.
-
The facts sit with system owners and the business, so every update starts as a chase.
-
Nothing in a spreadsheet tells you when it stopped being accurate.
-
Rebuilding the record before an inspection is the same work twice, done badly under time pressure.
Always audit-ready The record is a report, not a document you maintain
This is the part people have to see once before it clicks. The record in .legal is a read-only view, laid out like a spreadsheet, drawn from your processing activities.
-
You edit the processing activity. The record has nothing to edit, so it cannot drift from the source.
-
There is no save button, so the change takes effect wherever it is used immediately.
-
It is drawn per legal entity, because that is the unit the regulation asks for, and the company's details travel out with the export.
Always audit-ready Two records, and the second one answers the follow-up question
Article 30 sets a minimum, and a real audit conversation rarely stops there. So the same view is drawn two ways.
-
One holds the Article 30 requirements one to one, for when somebody asks for the statutory record.
-
The other adds further relevant information, the legal basis and the systems in use for example.
-
Either can be filtered down and drawn for a subset, one department rather than the whole company.
Always audit-ready Red markers instead of a green light
The platform does not tell you that you are compliant. It tells you how much of the record is filled in, and where the holes are.
-
Each activity carries a progress bar towards the record requirements, with red markers on the missing fields.
-
The dashboard carries the same figure for the whole organisation. A demo environment stood at 84% documented, which is an illustration of what the platform shows, not a benchmark.
-
Nothing is blocked while an activity is incomplete. Being fully documented at all times is not realistic, and we would rather show status than pretend.
Always audit-ready Correct it once, and the record follows
Processing activity, system and vendor are mapped to each other, so the same fact does not have to be maintained in three places.
-
A data processing agreement is uploaded once on the system and is then in every activity that system is attached to.
-
Add a sub-processor to a vendor and the platform offers to apply it everywhere that vendor is used, then fills it in once you accept. A prompt, never a silent update.
-
An intra-group sharing is registered once and appears on both records, the controller's Article 30(1) and the processing company's Article 30(2).
Always audit-ready What keeps it current when nobody is looking
Somebody still has to notice that a system changed. What the platform does is make sure the noticing is planned, owned and logged.
-
The recurring reviews sit in the annual wheel as tasks with named owners, deadlines and notifications.
-
When .legal invalidates a legal basis centrally, the affected places go red, the completion percentage falls, and you get the list. We do not change your documentation on your behalf.
-
Every single action on a processing activity is written to a full change log, which is what makes several colleagues in the same record safe rather than risky.
Always audit-ready Frameworks this covers
One record, kept to the requirement it exists for.
-
GDPR
Learn about GDPRArticle 30 is the obligation this page is about: a record for each legal entity, in the controller role and the processor role, kept current rather than reconstructed.
Our Customers
+400
companies
+10.000
users
+79.000
contracts
+14.000
processing activities
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
Use cases
Book demo
Find the job you need done
Every use case is a real piece of compliance work, told the way it actually runs in the platform. Filter by who you are, what you work with, and which frameworks you answer to.
Compliance & GRC leadCISO & IT securityDPOLegal counselExecutive & board
Energy & utilities
SMVMid-marketEnterprise & group
GDPRNIS2ISO 27001CIS18DORAePrivacyAI ActD-mærketData Act
Compliance & GRC lead
Run awareness training that reaches every colleague
Send out training and policies, chase the stragglers automatically, and prove every colleague completed it. You bring the material, we run the rails.
See awareness training
Compliance & GRC lead
Manage compliance across a group of companies
Run every company in the group from one platform, document once at group level, and still report entity by entity. Delivered by the Group Companies add-on.
See group compliance
Legal counsel
Run due diligence on your vendors
Classify a vendor on your own criteria, get the answers and documents you need with no login for them, and move the approved ones straight into contracts.
See vendor due diligence
Compliance & GRC lead
Multi-framework compliance: do the work once
Do a control once and it counts across every framework it maps to, with a simulated score on the ones you haven't started yet.
See multi-framework compliance
CISO & IT security
Get NIS2-ready without starting from scratch
Build on the ISO 27001 work you've already done, switch NIS2 on, and let a simulated score show how far ahead you already are.
See NIS2 readiness
DPO
From twelve spreadsheets to one record of processing
Your GDPR documentation already exists, it just lives in spreadsheets. Export what you have and we structure it in .legal for you, typically inside two weeks.
See the move off spreadsheets
No use cases match that combination yet. Try removing a filter.
