From scattered records to a working privacy platform in days

Day 1 (Foundation): the setup wizard provisions your tenant, the knowledge-base import loads your IT systems and vendors, connectors are configured (ServiceNow, Jira, SharePoint, cloud storage), your existing Article 30 RoPA is imported, Word/PDF DPIAs are batch-uploaded, and the first data-flow diagrams are drafted from imported records. Day 2 (Enhancement): AI drafts assessment templates from your historical responses, the enrichment pipeline tags every record with GDPR metadata (lawful basis, retention, transfer mechanism), vendor contract discovery locates DPAs and privacy notices, the risk register is reviewed, and workflows are switched on. Day 3 (Operational): team members log in to assigned tasks, the DPO reviews dashboards, scheduled sync runs against external sources, and the first new DPIA is launched. The DPC and ICO both expect a current Article 30 record at any audit moment — Day 3 means you can produce one.

An Article 30 import must preserve all seven controller fields the DPC and ICO look for in an audit: (a) controller and DPO identity, (b) processing purposes, (c) categories of data subjects and personal data, (d) categories of recipients including processors and third countries, (e) third-country transfers and the transfer mechanism (SCCs, adequacy decision, or derogation under Article 49), (f) retention periods, and (g) a general description of the technical and organisational measures under Article 32. Processors must additionally preserve the categories of processing carried out on behalf of each controller per Article 30(2). Acompli's import maps each column from your source export into these fields and flags any missing element so the gap is visible before go-live, not in front of a regulator.

Yes. Upload the folder of historical DPIAs as .docx or .pdf and the platform extracts each Article 35(7) section — systematic description, necessity and proportionality assessment, risks to data subjects, and safeguards — into a structured record while preserving the original document as evidence. The narrative answers are kept verbatim, then AI suggests matching template fields so the next iteration uses the same shape. EDPB Guidelines 04/2022 and the WP248 criteria are used as the classification spine for what counts as high-risk. The original file is hash-stamped and time-stamped against the imported record so the audit trail back to the source is intact.

It should preserve the records you already have, show what was imported, flag gaps before go-live, and leave an audit trail for the migration. In Acompli that means RoPA imports, historical DPIAs, vendor lists, transfer context and AI-system signals are mapped into governed records before the team starts new work.

Yes. The ServiceNow / Jira / cloud-storage connectors and spreadsheet imports populate the knowledge base of systems and vendors, and the enrichment pipeline tags each vendor with its hosting region and processing locations. Any flow to a non-EEA country is surfaced as a Schrems II item that requires either Standard Contractual Clauses with supplementary measures, an adequacy decision (e.g. UK, EU–US Data Privacy Framework for certified recipients), or an Article 49 derogation. The Schrems II judgment (C-311/18) and the DPC's €1.2bn Meta decision (May 2023) both make explicit that controllers must be able to demonstrate, per transfer, that the destination's surveillance regime does not undermine the protection — Acompli surfaces the transfer so the Transfer Impact Assessment is a focused workflow rather than a discovery exercise.

When the IT-asset inventory is imported, AI systems in the knowledge base are flagged for review against Annex III of the EU AI Act (the high-risk use cases including employment, education, essential services, law enforcement, migration, and justice). The AI Register module is available on opt-in (early access) and frames each entry across four classification fields — risk tier, Annex III applicability, Article 6(3) exception, and GPAI status. Self-attestation drives the classification; the platform structures the evidence but legal classification remains the controller's responsibility, working with counsel where needed. This is a roadmap area: today the value is rapid discovery and structured intake so an Annex III review is targeted rather than starting from a blank sheet.