Frequently asked questions

They should show a defensible Article 35 DPIA and a current Article 30 RoPA, with the evidence connected between them. A completed DPIA should help draft the relevant RoPA fields for review, transfers should carry their safeguards, and approvals should show who signed off and when. Acompli keeps those records linked instead of asking teams to reconcile separate documents.

Acompli imports the existing register, drafts updates from approved DPIAs and vendor assessments, and routes every change through human review. The result is a governed Article 30 record with version history and approval evidence, not a spreadsheet that has to be refreshed manually.

A completed DPIA already contains most of what Article 30 requires (purpose, categories, recipients, transfers, retention, security measures) and most of what a risk register needs (inherent risk, mitigations, residual risk, owner). The DPC and EDPB Guidelines 04/2022 expect these records to reconcile. In Acompli, an approved DPIA generates a draft RoPA entry and draft risk-register items that link back to the source assessment - the same evidence answers all three records, with one audit trail. The DPIA and Risk module pages explain how that spine is wired.

Excel registers usually carry years of institutional knowledge that an audit will reference. Migration should preserve every Article 30 field (purpose, categories of data subjects and personal data, recipients, third-country transfers, retention, security measures) plus your internal columns. Acompli imports Excel directly, maps your columns to Article 30 fields, and flags rows that are missing items the DPC or ICO will look for, such as the transfer mechanism for Schrems II suppliers. The original spreadsheet stays in the audit history.

Schrems II (CJEU C-311/18) and the subsequent DPC €1.2bn Meta decision raised the documentation bar for transfers outside the EEA. The record needs the transfer mechanism (SCCs, BCRs, derogation), a Transfer Impact Assessment for the recipient country, the supplementary measures applied (encryption, pseudonymisation, contractual), and a review date. EDPB Guidelines 04/2022 expect the TIA to live with the RoPA entry it relates to. Acompli links each Schrems II supplier in the third-party risk module to its RoPA entry and the TIA evidence.

GDPR Article 30(5) carves out organisations with fewer than 250 employees only where processing is occasional, not high-risk, and does not include special-category or criminal-offence data. In practice almost every Irish or UK SME meets at least one of those triggers (regular HR data, customer marketing, vendor processing) and therefore needs a RoPA. The DPC has been consistent that the carve-out is narrow, and the ICO takes the same line. Acompli is built so a single privacy lead in an SME can stand up a defensible Article 30 register without enterprise overhead.

A GDPR DPIA covers personal-data risk under Article 35; the EU AI Act adds a separate documentation layer for AI systems, with the high-risk obligations (Annex III) the most demanding. Deployers of an Annex III system in Ireland or the UK need to maintain an AI inventory, run a Fundamental Rights Impact Assessment where required, and evidence Article 50 transparency for systems that interact with people or generate synthetic content. A completed DPIA reuses cleanly into the AI Act record - same purpose, data, recipients - so the two should sit on one evidence spine. Acompli's AI Register is available on opt-in (early access) and is built to extend the DPIA and RoPA spine rather than duplicate it.

Most teams complete their first DPIA within the first week, with AI-assisted drafting and the team refining from there. By the end of the first month, teams typically have several completed assessments, AI-assisted RoPA entries (human-reviewed before approval), and a risk register that links back to source evidence — reviewable and traceable.

Acompli handles the administrative and documentation work — template generation, answer enhancement, risk extraction, and RoPA drafting — so your team can focus on the decisions that require human judgement. You remain in control of approvals, risk tolerance, and governance.

Yes. Acompli generates tailored DPIA templates based on your scenarios, but it works best alongside your existing policies and governance framework. It helps you apply those policies consistently and capture the evidence.

Yes. Workflows, roles and stages are configurable. You can keep things simple or model a more detailed approval process. The aim is to fit Acompli to your organisation, not the other way round.

The people completing assessments see a guided, straightforward experience: clear questions, focused help and tools to refine their own answers. The more advanced features – workflow configuration, risk views, RoPA management – are available to those who need them.

Approved assessments generate draft RoPA entries and risk register items for review. The Knowledge Base captures systems, vendors and locations mentioned in responses, improving AI context for future assessments. Everything links back to source evidence.

Customer Content remains under the customer's rights. Acompli does not use Customer Content to train its own general-purpose models and does not sell personal data. AI features produce reviewable suggestions with confidence indicators and audit history. For OpenAI API processing, OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring unless configured for Zero Data Retention where eligible, and OpenAI does not train on API inputs/outputs by default unless an organisation explicitly opts in.

Every AI output includes a confidence score. High-confidence outputs are typically accurate; lower scores indicate where human review should focus. Nothing publishes without approval - the review queue preserves accountability, approval history and audit context.

No. It is designed so that a single privacy lead in an SME can get value quickly, but it can also support more complex approval chains and reporting requirements in larger organisations.

Yes. Acompli supports Excel imports, CSV bulk imports for systems and third parties, and manual data entry. AI helps map your existing structure to Acompli's format, so migration does not mean starting from scratch.