Review user's responsibilities
A table on the colleague's own user page listing every area where they are named, with a count on each. Empty areas are hidden, so what you are looking at is that person's actual footprint rather than a checklist.
Hand over everything a colleague was responsible for
Somebody leaves, and their name is still on contracts, processing activities, assets and the tasks that document your controls. One table on their user page lists every place they are named as responsible, with a count, and you hand each one to the colleague who should have it.
Unlimited users • Free onboarding and support • No commitment
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=34&height=26&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png){kind=small}
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=225&height=26&name=KAUFMANN%20(1).jpg){kind=small}
Responsibility handover
Meridian stopped finding out about handovers a year late
Maria Holm is the person at Meridian Nordic who administers the platform, on top of leading GRC, which means every leaver ends up on her desk. Meridian is 850 people across three entities, so somebody changes job most months. The leaving was never the hard part. A departed colleague's name stayed on contracts as contract manager, on the tasks that document ISO 27001 controls, on processing activities and on obligations, and it usually surfaced a quarter later when a deadline went red and the reminder went to a mailbox nobody reads. Now she opens that person's own user page, reads one table of everything they were named on, and hands each piece to the colleague who should have it.
-
One table lists every area where a colleague is named as responsible, with a count on each.
-
The transfer list names the capacity, so a contract can move its SLA responsibility without moving the contract.
-
Everything goes to one colleague in a single action, or an area gets split between several.
-
Deactivate somebody before the handover and the responsible field flags red, so it does not stay quiet.
Responsibility handover
The leaving is not the problem. The name that stays is
Nothing breaks when a colleague walks out of the door, and that is exactly why it takes so long to notice. The documentation still looks complete, because there is still a name on it.
-
A departed colleague can still be the contract manager on a live contract, the responsible on a recurring control and the owner of an obligation.
-
Nothing stops working, so nobody notices until a deadline goes red or an auditor asks who owns something.
-
Reconstructing everything one person held, from memory and across the whole platform, is work nobody planned for.
Responsibility handover
One table, one person's whole footprint
Open the colleague's user page and there is a section headed "Review user's responsibilities". It is a plain table: the area, and how many things they hold in it.
-
The areas run across the platform: contracts, processing activities, assets, tasks and annual wheel activities, frameworks, external audits and internal assessments, legal entities, and more.
-
Empty areas are hidden, so the table is the shape of that person's actual holdings rather than a list of everything the platform could contain.
-
The count is doing real work here. Somebody who has been closing controls for a few years can hold hundreds of tasks, and you can see that before you promise anybody a quick handover.
Responsibility handover
You are moving a role, not a record
This is the detail that makes the difference between a tidy handover and a blunt one. The transfer list has a field column, so it names the capacity the person is attached in, and the same contract appears once per capacity.
-
One contract can turn up three times: as contract manager, as SLA responsible, and in a third capacity on the same contract.
-
So the SLA reporting can go to operations while the contract itself stays with legal, in the same pass.
-
"Additional user access" really is access, so on contracts the table does show where a person holds access and lets you move it. That is true of contracts and it does not extend further than contracts.
Responsibility handover
Everything at once, or one item at a time
Two routes, and which one you want depends on whether somebody is being replaced or being split up.
-
Move the whole lot from one user to another in a single action, for the straightforward swap.
-
Or open an area and hand individual items to different colleagues until it is empty. Contracts, assets and processing activities work that way, and a long list can be searched.
-
It takes a role that may administer users, so the handover sits with whoever administers the platform rather than with the people who own the records.
Responsibility handover
If it has to happen every quarter, it belongs in the annual wheel
The table is on demand. You open a user when you need to, and nothing about the screen makes it periodic, so the cadence has to come from somewhere else.
-
Put "check who is responsible for what" in the annual wheel (årshjul) as an activity with a frequency and an owner, in weeks, months or years.
-
The activity generates a task each time it falls due, and the note, the decision and the document you upload all belong on the task.
-
The review itself leaves no trail. Nothing records that somebody looked at a user on a date, so the task is what carries the documentation.
Responsibility handover
Rails, not a watchdog
We give you the list and the means to clear it. Noticing that somebody has left is still a human job, and there are three limits worth having before a demo rather than after one.
-
Nothing scans for documentation whose owner has gone. The red flag appears when you deactivate somebody, on the record itself, and for a user deactivated long ago without a handover there is nothing that surfaces it now.
-
This is responsibility for your own documentation inside .legal. It does not reach into who can log in to your other systems, and nothing here is tied to a framework template.
-
The handover is an administrator's job. It is not delegated to business area owners or system owners, so plan the process centrally.
Our Customers
+400
companies
+11.000
users
+79.000
contracts
+14.000
processing activities
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
Use cases
Book demo
Find the job you need done
Every use case is a real piece of compliance work, told the way it actually runs in the platform. Filter by who you are, what you work with, and which frameworks you answer to.
Compliance & GRC leadCISO & IT securityDPOLegal counselExecutive & board
Energy & utilitiesFinancial servicesManufacturingPublic sectorHealthcareProfessional servicesRetail & e-commerceTechnology
SMVMid-marketEnterprise & group
GDPRNIS2ISO 27001CIS18DORAePrivacyAI ActD-mærketData Act
CISO & IT security
Run your ISMS in one platform
The frameworks you answer to, the controls beneath them and the documentation that proves the work happened, all three in one module, with status updating itself from completed tasks.
See how the ISMS runs
Legal counsel
Contract management with obligations and renewals
Register what each contract obliges you to do, delegate it as tasks with deadlines, and see in one overview that it gets done on time. Renewals notify ahead of the date.
See obligations and renewals
Compliance & GRC lead
Manage compliance across a group of companies
Run every company in the group from one platform, document once at group level, and still report entity by entity. Delivered by the Group Companies add-on.
See group compliance
Compliance & GRC lead
Run awareness training that reaches every colleague
Send out training and policies, chase the stragglers automatically, and prove every colleague completed it. You bring the material, we run the rails.
See awareness training
Legal counsel
Run due diligence on your vendors
Classify a vendor on your own criteria, get the answers and documents you need with no login for them, and move the approved ones straight into contracts.
See vendor due diligence
Compliance & GRC lead
Multi-framework compliance: do the work once
Do a control once and it counts across every framework it maps to, with a simulated score on the ones you haven't started yet.
See multi-framework compliance
CISO & IT security
Get NIS2-ready without starting from scratch
Build on the ISO 27001 work you've already done, switch NIS2 on, and let a simulated score show how far ahead you already are.
See NIS2 readiness
DPO
From twelve spreadsheets to one record of processing
Your GDPR documentation already exists, it just lives in spreadsheets. Export what you have and we structure it in .legal for you, typically inside two weeks.
See the move off spreadsheets
Compliance & GRC lead
Build one risk register for the whole organisation
One register across GDPR, NIS2, AI and information security, where each risk area keeps its own matrix, scale and appetite. Delivered by the Enterprise Risk Management add-on.
See the risk register
Executive & board
Give the board a risk picture it can act on
One management report across every risk area: entities assessed, risks above appetite, exposure now and once the open plans are done. Export it with your own comment on it.
See board risk reporting
DPO
Keep your records of processing always audit-ready
The Article 30 record is a report drawn from your processing activities, not a document you rebuild before an inspection. Correct an activity and the record says so immediately.
See the record stay current
Compliance & GRC lead
Get ready for the D-seal
D-Seal's own criteria sit in the platform under a formal agreement with D-Seal, mapped 1:1 with the level 3 criteria. Work the controls, collect the documentation, export it per task.
See the D-seal route
CISO & IT security
Achieve and maintain ISO 27001 certification
The certificate is won at the audit and kept alive in the years between. Work the controls under the standard's own numbering and plan the whole cycle in one pass.
See the certification route
CISO & IT security
One incident log for GDPR and NIS2
A personal data breach and a security incident go in the same register, on the same form. Record it, attach the documentation, delegate the follow-up, and export it when somebody asks.
See the incident log
CISO & IT security
Secure the supplier chain NIS2 holds you responsible for
Register the supplier, classify it on criteria you set yourself, get the answers and documents out of it without a login, then assess it as a risk in your NIS2 risk area.
See the supplier chain end to end
DPO
Every data processing agreement, and the ones that are missing
Put every data processor next to its agreement and the gaps stop hiding. Register the agreement once, reference it from everything that relies on it, and change it in one place.
See the agreements and the gaps
Legal counsel
Put AI to work on your contract portfolio
Three jobs AI does on contracts today: it fills the register from the document you already have, checks a contract against your own best practice, and answers questions across the portfolio. All of it in beta.
See AI on the contract portfolio
CISO & IT security
Catch the risk when somebody notices it
One public link with no login, so a colleague can report what they spotted from a phone in half a minute. It lands in an inbox with an owner, where a person decides whether it becomes a risk scenario.
See how an observation lands
DPO
Run your DPIAs where the processing activity already lives
Run a DPIA as an internal assessment on the same audit engine you already send questionnaires with. You write the questions yourself, and when the answers come back you relate them to the processing activity they concern.
See DPIAs on the activity
CISO & IT security
Put a number on the risk, and on what it costs to fix
Exposure before a mitigation plan, exposure after it, and what the plan costs. Compare competing plans on figures you supply yourself, in order of magnitude and direction rather than two decimal places.
See the numbers behind the plans
DPO
Map your personal data to the systems that hold it
Start from the system and see which personal data sits in it, gathered from every processing activity it's attached to. Nothing is scanned for you.
See the system's personal data
CISO & IT security
Know who has signed off which version of the policy
Publish a policy version, then ask for sign-off as a separate step. Each version keeps its own log of who has signed off and who is still missing.
See sign-off per version
No use cases match that combination yet. Try removing a filter.