Assessments

Run structured assessments for GDPR and the EU AI Act

Six stages connect assessment work to the systems, suppliers, documents, and records behind it — with better starting points and human-reviewed results.

01Templates02Context03Drafting04Review05Outputs06Continuity

Get started →

View Brochure

How it works

From template to reviewed output

Six stages connect assessment work to the systems, documents, and records behind it. Every assessment builds on the last.

StartChoose your assessment

Pre-built templates or build your own

Start with a structured template for DPIAs, LIAs, TIAs, processor assessments, employee data reviews, AI governance workflows, and related regulatory assessments — or use the AI template builder to generate a tailored assessment from scratch.

The AI template builder automatically tags every RoPA-affiliated question field as it generates your template. Article 30 fields — legal basis, data categories, recipients, retention periods — are mapped before a single answer is written.

DPIAs

Higher-risk processing and formal privacy risk review under GDPR Article 35.

Processor Assessments

Vendor oversight, due diligence, and contract governance reviews.

Transfer Impact Assessments

International transfers, supplementary measures, and transfer governance.

IT & Change Assessments

New systems, migrations, and technology implementations involving personal data.

EU AI Act Assessments

AI classification, governance, transparency, and human oversight obligations.

Custom Assessments

Create tailored workflows for your own governance or operational requirements.

01Contextual Completion

Work from real organisational context

Contributors complete assessments with access to the systems, suppliers, locations, documents, and organisational records that matter — so the assessment starts from real context rather than a blank page.

Certain question types connect directly to your Knowledge Base. When an assessment asks which IT systems are involved, respondents select from your actual system inventory. The assessment and the data map stay in sync automatically.

Context

Systems & ProcessorsSelect from your registered IT estate and managed supplier list.

Project DocumentsContracts, DPAs, retention schedules, vendor questionnaires — parsed and indexed.

Locations & TransfersRegistered locations, transfer mechanisms, and safeguards.

02AI-Assisted Drafting

Better drafts before they reach the reviewer

AI co-pilots help contributors produce clearer and more complete responses. Advisory explains what “good” looks like for each question. Refinement improves wording on demand — per question or in bulk.

Every suggestion is optional, versioned, and traceable. The DPO sees exactly what the AI proposed and what the human accepted. Confidence scoring identifies low-certainty responses before they reach review.

DPIA — Employee Monitoring System

Processing purpose & lawful basisEnhanced

Data categories & retention periodsEnhanced

Necessity & proportionalityReview

Transfer impact assessmentPrecedent

Rights & freedoms risk analysisEnhanced

Risk mitigation measuresFlagged

Advisory co-pilotExplains what “good” looks like for every question

Polishes wording on demand, in bulk or per question

03Review & Approval

Human judgement stays in the loop

Assessments move through a structured workflow with comments, tasks, approvals, and audit history. Nothing becomes a published record without human review and sign-off.

Role-based permissions give contributors, reviewers, and decision-makers the views and controls appropriate to their role. Compliance gating prevents publication of incomplete or unreviewed work.

Comments & Tasks

Reviewers leave targeted feedback on specific responses. Tasks track open actions with assignees and due dates.

Structured Approval

Assessments pass through defined approval stages. Each step is recorded with timestamp, approver, and decision.

Audit History

Every comment, change, approval, and review action is linked to the assessment with a full audit trail.

Principle →AI handles the drafting. Humans make the decisions.

04Connected Outputs

Approved work feeds the wider compliance record

Once approved, assessment outputs support connected risk records, Article 30 records, a searchable archive, and curated precedents — within a single connected platform.

Every output carries provenance: which question contributed the value, the answer text that was the source, what extraction logic was applied, and who approved the assessment. Trace from a RoPA record back to the original evidence in one click.

Risk Register

Risks extracted with provenance

Severity, category, source assessment, and a link to the original question and answer.

RoPA Records

Article 30 fields auto-populated

Legal basis, data categories, recipients, retention — populated from tagged responses.

Searchable assessment archive

AI-generated summary, structured tags, and risk levels — indexed for future reference.

Precedents

Best answers become standards

High-quality answers surfaced as candidates. The DPO curates which become authoritative.

05Continuity

Every assessment makes the next one better

The next assessment benefits from the updated registry, the expanded document library, the enriched archive, and any newly approved precedents. Context survives people changes. Institutional knowledge compounds.

Past assessments remain available for future reference, helping teams reuse relevant context, prior analysis, and approved records when similar projects arise again. The programme improves through the compliance work your organisation is already conducting.

Compound

Registry

Practical features that support real assessment work

🎙

Voice Dictation

Dictate responses during drafting and refinement.

📥

Response Import

Collect responses offline in Excel and import them back.

📄

PDF & Excel Reports

Structured outputs for review, sharing, and record keeping.

🏢

Multi-Entity Support

Scope assessments to the relevant legal entity.

🔐

Role-Based Access

Control who can contribute, review, approve, and administer.

💬

Teams Integration

Work with assessments through Microsoft Teams.

See assessments in action

Run structured assessments connected to your systems, documents, and records. Better starting points. Human-reviewed results.

Get started →Book a walkthrough

Frequently Asked Questions

Will it reduce assessment turnaround time?

Yes. Assessments start from organisational knowledge — registered systems, processors, locations, and prior approved positions — rather than a blank page. AI co-pilots advise respondents on what a well-formed response entails. Bulk enhancement raises quality before the assessment reaches the reviewer. The DPO spends time on governance decisions, not redrafting incomplete responses.

Will it improve consistency across assessors?

Consistency is enforced structurally. Templates include conditional logic, compliance gating, and Article 30 field mapping. Confidence scoring identifies low-certainty responses. Consistency analysis cross-references answers across sections to flag contradictions and duplicates. The result is that two different assessors working on the same type of processing produce comparable, defensible outputs — regardless of individual experience level.

Will findings transfer downstream?

Three things happen when an assessment is approved. Draft risk entries are extracted, categorised by type, and scored by severity — ready for DPO review in the Risk Register. Draft Article 30 records are generated from the mapped fields — processing purposes, legal bases, data categories, recipients, transfers, retention, and safeguards. And the approved assessment enters the searchable archive, where its positions, precedents, and findings enrich every future assessment.

Does it replace the DPO?

No. Acompli removes the administrative burden — template selection, guidance delivery, response enhancement, consistency checking — so that the DPO's time goes to risk assessment, mitigation design, and governance decisions that require professional judgement. Every AI-generated output requires human review and approval before it is published. The DPO remains the accountable authority. Acompli makes that authority scalable.

How does the Knowledge Base connection work?

Certain question types are directly connected to your organisational Knowledge Base. When an assessment asks which IT systems are involved, respondents select from your actual system inventory. When it asks which processors are involved, they select from your managed processor list. When it asks where data is located, they select from your registered locations. The assessment and the data map stay in sync automatically, and AI enhancement draws on this context to produce grounded, organisation-specific answers.

What assessment types are supported?

Acompli includes templates for standard DPIAs, IT systems assessments, HR and employee data, marketing and communications, automated decision-making under Article 22, EU AI Act conformity assessments, and Article 28 processor evaluations. You can also create custom templates using the Template Builder or describe what you need in plain language and let the AI Template Generator produce a complete, structured template for you to refine and publish.

Can I import responses from offline contributors?

What does it cost?