Internal assessments on the audit engine
An internal assessment is a template with its Type set to Internal, built and sent on the same engine as your supplier audits. One engine, pointed inwards at a colleague instead of outwards at a vendor.
Run your DPIAs where the processing activity already lives
An internal assessment goes out on the same engine you already send questionnaires with, and when it comes back you relate it to the processing activity it concerns, with its ID on it. You write the questions yourself, so a DPIA can follow your own method rather than a template of ours.
Unlimited users • Free onboarding and support • No commitment
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=34&height=26&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png){kind=small}
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=225&height=26&name=KAUFMANN%20(1).jpg){kind=small}
DPIAs on the activity
Meridian's forecasting pilot got assessed, and the internal assessment is still findable a year later
Sofie Bruhn is the DPO for the whole of Meridian Nordic. When the group decided that its consumption-forecasting pilot had to be properly assessed before it went anywhere near live metering data, she had done that job before: in a document, on a shared drive, followed a year later by an afternoon spent working out which activity it had actually been about. This time she wrote the questions once, as an internal assessment, and sent it to the engineer who runs the platform with a colleague named as responsible for it. When it came back she related it to the processing activity from the activity's own tab, where it now sits with its ID next to it.
-
The questions are Meridian's own, in one template that gets reused rather than rewritten.
-
It goes to the colleague who actually knows the system, and the responsible party is emailed when it lands.
-
Once she relates it to the processing activity it stays there with its ID, so next year it is one click from the activity.
-
Sofie can see sent, opened and submitted, and on a template without branching how far through the recipient has got, without asking anyone how it is going.
DPIAs on the activity
The DPIA nobody can find a year later
Doing the DPIA is rarely the hard part. Finding it afterwards, and showing that it belonged to the activity that actually went live, is where this work usually falls down.
-
A document on a shared drive has no relationship to the activity it was written about.
-
The colleague who answered the questions has changed team, and their answers were in an email thread.
-
A year on, nobody can say for certain whether the version running now is the version that was assessed.
DPIAs on the activity
There is no DPIA module, and that is the honest starting point
We would rather put that in writing than let a demo deliver it. What the platform has is an internal assessment: a questionnaire template with its Type set to Internal, which is what .legal built this part of the engine for.
-
No DPIA object, no wizard, no DPIA-specific fields and no GDPR logic inside it.
-
The same engine sends supplier audits and knowledge checks. An internal assessment is a third job for it.
-
Because nothing in it is shaped around GDPR, it can carry your own method rather than ours.
DPIAs on the activity
It belongs to the processing activity, not to a folder
This is the part that makes the difference. You relate the submitted internal assessment to the activity it concerns, and from then on it is documentation on that activity rather than a document in a folder.
-
Processing activities and assets each carry an internal assessments tab, and that is where you relate one, with its ID in parentheses.
-
On an activity, the audit tab toggles between the internal assessments and the external audits attached to it.
-
It is related to the activity and never merged into it, so nothing in an internal assessment rewrites the activity's own fields.
DPIAs on the activity
Getting the answers out of the colleague who knows
The DPO rarely holds the facts. The engineer does, or the project manager, and neither of them wants an account in a compliance platform.
-
Send it to a named contact person, chosen from the contact persons on your group companies.
-
Or share a public link, where the respondent puts in their own name and email to get started.
-
A note travels with that link and shows as a tooltip in the overview, which is where people write which project it covers.
DPIAs on the activity
A date you record, and a cadence you do not choose
Two facts sit next to each other here, and they are easy to blur into a promise we cannot make. So, plainly.
-
The deadline is recorded and enforces nothing. Your recipient can still submit after it has passed.
-
Reminders go to anyone who has not answered after 7 days, 14 days and 21 days, and then keep going.
-
The cadence is not something you can change, so it is worth building your follow-up around it.
DPIAs on the activity
The call is still yours to make
We build the plan, not the filling-in. On work like this, that line has three edges worth naming before you see a demo.
-
Nothing screens your activities and nothing tells you a DPIA is needed. That call is yours and your adviser's.
-
Scoring is optional on the template and generic when it is on. A number here is not a data protection verdict.
-
Nothing is monitored or detected. The platform holds what a person submitted, and when they submitted it.
DPIAs on the activity
Frameworks this covers
One regulation, and the documentation kept where the work already sits.
-
GDPR
Learn about GDPRYour DPIAs are GDPR work, and so are the processing activities you relate them to. .legal keeps both as documentation you can find again, rather than as documents you have to remember where you put.
Our Customers
+400
companies
+11.000
users
+79.000
contracts
+14.000
processing activities
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
Use cases
Book demo
Find the job you need done
Every use case is a real piece of compliance work, told the way it actually runs in the platform. Filter by who you are, what you work with, and which frameworks you answer to.
Compliance & GRC leadCISO & IT securityDPOLegal counselExecutive & board
Energy & utilitiesFinancial servicesManufacturingPublic sectorHealthcareProfessional servicesRetail & e-commerceTechnology
SMVMid-marketEnterprise & group
GDPRNIS2ISO 27001CIS18DORAePrivacyAI ActD-mærketData Act
DPO
Keep your records of processing always audit-ready
The Article 30 record is a report drawn from your processing activities, not a document you rebuild before an inspection. Correct an activity and the record says so immediately.
See the record stay current
Legal counsel
Run due diligence on your vendors
Classify a vendor on your own criteria, get the answers and documents you need with no login for them, and move the approved ones straight into contracts.
See vendor due diligence
Compliance & GRC lead
Run awareness training that reaches every colleague
Send out training and policies, chase the stragglers automatically, and prove every colleague completed it. You bring the material, we run the rails.
See awareness training
Compliance & GRC lead
Manage compliance across a group of companies
Run every company in the group from one platform, document once at group level, and still report entity by entity. Delivered by the Group Companies add-on.
See group compliance
Compliance & GRC lead
Multi-framework compliance: do the work once
Do a control once and it counts across every framework it maps to, with a simulated score on the ones you haven't started yet.
See multi-framework compliance
CISO & IT security
Get NIS2-ready without starting from scratch
Build on the ISO 27001 work you've already done, switch NIS2 on, and let a simulated score show how far ahead you already are.
See NIS2 readiness
DPO
From twelve spreadsheets to one record of processing
Your GDPR documentation already exists, it just lives in spreadsheets. Export what you have and we structure it in .legal for you, typically inside two weeks.
See the move off spreadsheets
Compliance & GRC lead
Build one risk register for the whole organisation
One register across GDPR, NIS2, AI and information security, where each risk area keeps its own matrix, scale and appetite. Delivered by the Enterprise Risk Management add-on.
See the risk register
Executive & board
Give the board a risk picture it can act on
One management report across every risk area: entities assessed, risks above appetite, exposure now and once the open plans are done. Export it with your own comment on it.
See board risk reporting
CISO & IT security
Run your ISMS in one platform
The frameworks you answer to, the controls beneath them and the documentation that proves the work happened, all three in one module, with status updating itself from completed tasks.
See how the ISMS runs
Compliance & GRC lead
Get ready for the D-seal
D-Seal's own criteria sit in the platform under a formal agreement with D-Seal, mapped 1:1 with the level 3 criteria. Work the controls, collect the documentation, export it per task.
See the D-seal route
Legal counsel
Contract management with obligations and renewals
Register what each contract obliges you to do, delegate it as tasks with deadlines, and see in one overview that it gets done on time. Renewals notify ahead of the date.
See obligations and renewals
CISO & IT security
Achieve and maintain ISO 27001 certification
The certificate is won at the audit and kept alive in the years between. Work the controls under the standard's own numbering and plan the whole cycle in one pass.
See the certification route
CISO & IT security
One incident log for GDPR and NIS2
A personal data breach and a security incident go in the same register, on the same form. Record it, attach the documentation, delegate the follow-up, and export it when somebody asks.
See the incident log
CISO & IT security
Secure the supplier chain NIS2 holds you responsible for
Register the supplier, classify it on criteria you set yourself, get the answers and documents out of it without a login, then assess it as a risk in your NIS2 risk area.
See the supplier chain end to end
DPO
Every data processing agreement, and the ones that are missing
Put every data processor next to its agreement and the gaps stop hiding. Register the agreement once, reference it from everything that relies on it, and change it in one place.
See the agreements and the gaps
Legal counsel
Put AI to work on your contract portfolio
Three jobs AI does on contracts today: it fills the register from the document you already have, checks a contract against your own best practice, and answers questions across the portfolio. All of it in beta.
See AI on the contract portfolio
Compliance & GRC lead
Hand over everything a colleague was responsible for
Somebody leaves and their name is still on contracts, processing activities, assets and the tasks that document your controls. One table lists every place they are named as responsible, and you hand each role to the colleague who should have it.
See the handover
CISO & IT security
Catch the risk when somebody notices it
One public link with no login, so a colleague can report what they spotted from a phone in half a minute. It lands in an inbox with an owner, where a person decides whether it becomes a risk scenario.
See how an observation lands
CISO & IT security
Put a number on the risk, and on what it costs to fix
Exposure before a mitigation plan, exposure after it, and what the plan costs. Compare competing plans on figures you supply yourself, in order of magnitude and direction rather than two decimal places.
See the numbers behind the plans
DPO
Map your personal data to the systems that hold it
Start from the system and see which personal data sits in it, gathered from every processing activity it's attached to. Nothing is scanned for you.
See the system's personal data
CISO & IT security
Know who has signed off which version of the policy
Publish a policy version, then ask for sign-off as a separate step. Each version keeps its own log of who has signed off and who is still missing.
See sign-off per version
No use cases match that combination yet. Try removing a filter.