Privacy assessment software your reviewers can stand behind

It should cover the assessments that feed the wider privacy programme: DPIAs and PIAs, legitimate-interest assessments, transfer impact assessments, vendor and processor reviews, and EU AI Act assessments where relevant. In Acompli those workflows share the same evidence, approval and downstream update model, so approved answers can inform RoPA and risk records without re-keying.

Yes — GDPR Article 35(1) makes a DPIA mandatory before processing likely to result in a high risk to individuals, enforced by the DPC in Ireland and the ICO in the UK, with both regulators publishing screening lists of operations that always require one. The full when-mandatory explainer — the DPC and ICO lists, the EDPB WP248 rev.01 nine criteria, and the Article 35(7) contents — is on the DPIA guide. On this page the point is operational: Acompli runs the DPIA, routes it through human review, and feeds the approved output into your Article 30 RoPA and risk register.

Yes. Assessments start from organisational knowledge — registered systems, processors, locations, and prior approved positions — rather than a blank page. AI co-pilots advise respondents on what a well-formed Article 35 response looks like, and bulk enhancement raises quality before the assessment reaches the reviewer. The DPO spends time on the judgements the DPC and ICO actually scrutinise (necessity, proportionality, mitigations) rather than redrafting incomplete responses.

Consistency is enforced structurally. Templates carry conditional logic, compliance gating, and Article 30 field mapping. Confidence scoring identifies low-certainty responses; consistency analysis cross-references answers across sections to flag contradictions. The result is that two different assessors working on the same type of processing produce comparable, defensible outputs that match what the DPC or ICO would expect to see if it asked for the DPIA file.

On approval, three things happen. Draft risk entries are extracted, categorised by type, and scored — ready for DPO review in the Risk Register. Draft Article 30 RoPA records are generated from the mapped fields (purposes, legal bases, data categories, recipients, transfers, retention, safeguards) with provenance back to the DPIA Q&A that produced each field. The approved assessment also enters the searchable archive so its positions become reusable precedent. This matches the EDPB's expectation that DPIA, RoPA, and risk records form one evidence chain rather than parallel registers.

No. Acompli removes the administrative burden — template selection, guidance delivery, response enhancement, consistency checking — so the DPO's time goes to the risk and governance judgement the DPC and ICO expect a qualified DPO to apply under Article 39. Every AI-assisted output requires human review and approval before it is relied on. The DPO remains the accountable authority.

Certain question types are directly connected to the organisational Knowledge Base. When a DPIA asks which IT systems are involved, respondents select from the actual system inventory; processors are picked from the managed list; data locations come from registered locations. The DPIA and the Article 30 data map stay in sync through mapped fields and review, and AI enhancement draws on this context to produce grounded answers. This avoids the common DPC audit finding that DPIAs reference systems, processors, or transfers that do not match the Article 30 record.

Yes. Acompli generates a downloadable Excel response template for each assessment. Distribute it to contributors who work offline, then import the completed responses; the system validates and maps each response to the correct question. This matters in Irish and UK group structures where business owners outside the privacy team contribute to a DPIA but should not have full platform access.

The full assessment capability — template library, AI co-pilots, bulk enhancement, approval workflows, compliance gating, risk extraction, RoPA generation, archive intelligence, and Knowledge Base integration — is included in every Acompli plan. There is no separate assessment module or per-assessment charge. Pricing is the same regardless of whether the assessment is a DPIA under Article 35, an Article 28 processor evaluation, or a transfer impact assessment for Schrems II compliance.

Approved assessments produce draft risk entries, draft Article 30 RoPA records, and reusable precedent evidence for future work. Acompli maps assessment answers to downstream records through review-controlled workflows, with each downstream record citing the source assessment answer for audit-defensible traceability. The DPC expects controllers to be able to evidence how a DPIA conclusion influenced the corresponding RoPA entry — this provenance is the evidence.

Yes for the GDPR assessments. The DPIA (UK GDPR Article 35), the Legitimate Interests Assessment behind an Article 6(1)(f) basis — for which the ICO expects the three-part purpose, necessity and balancing test recorded as an LIA — and transfer assessments all apply under the UK GDPR, enforced by the Information Commissioner's Office (ICO) rather than the DPC. UK restricted transfers use the ICO's International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses plus the UK Addendum, assessed through the ICO's transfer risk assessment (TRA) — now referred to in UK law as a data protection test — rather than the EU clauses alone. The one assessment that does not apply in the UK is the EU AI Act's Fundamental Rights Impact Assessment (FRIA, Article 27): the EU AI Act is not UK law, so there is no UK FRIA duty, although a UK organisation deploying high-risk AI that affects people in the EU can still be caught by the EU obligation. Acompli runs the UK assessments on the same workflow as the Irish ones, anchored to the ICO and the UK GDPR.

A privacy assessment platform is software that runs an organisation's privacy assessments — DPIAs and PIAs under GDPR Article 35, legitimate-interest assessments, transfer impact assessments after Schrems II, Article 28 vendor and processor reviews, and EU AI Act assessments — on one governed workflow rather than as scattered documents. What distinguishes a platform from a single-assessment tool is that approved answers are reused across these assessment types and flow downstream into the Article 30 RoPA and risk register. In Acompli every assessment is template-started, drafted from your knowledge base with each AI draft flagged for review, and signed off by a named approver, so the output is a connected, evidence-linked decision record across all five assessment types rather than a folder of files.

The best privacy assessment software is decided less by how many templates it ships than by whether each assessment starts from your real organisational knowledge, keeps a named human accountable for every conclusion, and feeds its approved output downstream into the Article 30 RoPA and risk register rather than sitting in a folder. Acompli's angle is to govern these as connected, human-approved records tied to the wider GDPR and EU AI Act programme, each assessment answer traceable to approved evidence. For a neutral, evidence-based comparison, our full comparison library compiles capability charts and vendor-by-vendor breakdowns from public sources, and says openly where rival tools outperform Acompli.