Compliance answer pages
Canonical guides and regulatory explainers for DPIA, RoPA, transfers, GDPR fines, and AI Act readiness.
Research
Design decisions behind responsible AI compliance
AI can help compliance teams move faster, but only when outputs are governed, reviewable and grounded in evidence. Acompli research explains the design choices behind the platform.
Research areas
Practical guidance and platform design in one index
Compliance guides, responsible AI design notes and platform engineering papers stay together so teams can connect regulatory change to workflow action.
Compliance software, by category
Head-term guides to the software behind each core privacy workflow — what each does, how it works, and what to look for in a tool a DPC or ICO inspection would test.
DPIA and privacy assessments
Assessment-specific guides for choosing the right assessment, running a DPIA, keeping templates defensible, and comparing assessment software.
Privacy risk management
Guides for building an evidence-linked privacy risk register, comparing risk tools, and scoring inherent and residual exposure.
RoPA software
The Record of Processing Activities category — what RoPA software is, how to compare tools, automation, templates, worked examples, and a step-by-step.
Freshness and tools
Pages designed for current-year answers, practical calculations, and ongoing regulatory updates.
DSAR Software Compared: How to Choose a Subject Access Request Tool
How to compare DSAR software across identity verification, the Article 12(3) clock, search breadth, human-reviewed redaction, UK and EU overlays, and a self-contained audit trail.
Read paper →How to Conduct a DPIA: A Step-by-Step Guide
The Article 35 DPIA process step by step: screen, describe, assess necessity, assess risk, mitigate, record DPO advice, sign off, consult and review.
Read paper →DPIA Template: Article 35(7) Fields
The four Article 35(7) content elements a DPIA must contain, plus DPO advice and the residual-risk decision a regulator will expect to see.
Read paper →Types of Privacy Assessment: DPIA, LIA, TIA, PIA and FRIA
DPIA, LIA, TIA, Article 28 review, PIA and FRIA: what each privacy assessment is, its legal basis, and when it applies.
Read paper →Compliance Guides
Legitimate Interests Assessment TemplateThe fields an LIA should record: purpose, necessity and balancing tests under GDPR Article 6(1)(f), and how to keep the assessment defensible.
Compliance GuidesPrivacy Assessment Software ComparedThe four types of privacy assessment tool, what each is best for, the criteria to score them on, and how to choose.
Compliance GuidesPrivacy Risk Software ComparedThe four types of privacy risk tool, what each is best for, the criteria to score them on, and how to choose the right one.
Compliance GuidesPrivacy Risk Register TemplateThe fields a defensible GDPR risk register should contain: source, inherent vs residual scoring, treatment plan, owner and review.
Compliance GuidesInherent vs Residual Risk: GDPR Risk Scoring ExplainedThe two scores a GDPR risk assessment records, why both matter, and how to score risk before and after controls.
Compliance GuidesRoPA Software Compared: How to Choose an Article 30 ToolHow to compare RoPA software on the criteria a DPC or ICO inspection tests: Article 30(1)/(2) coverage, multi-entity scoping, evidence traceability, version history and a Schrems II transfer view.
Compliance GuidesRoPA Automation: What It Should (and Shouldn’t) AutomateWhat RoPA automation honestly means: the register stays current without re-keying, with per-field confidence scores and a named human approving every record.
Compliance GuidesArticle 30 (RoPA) Template: Fields for EU & UK GDPRThe mandatory Article 30(1) controller fields and the parallel Article 30(2) processor fields, with a downloadable template you can fill and maintain.
Compliance GuidesHow to Create a RoPA (Article 30): Step by StepA step-by-step guide to building a Record of Processing Activities under Article 30 — identify, map, document, review and maintain, with a named human approving the record.
Compliance GuidesRoPA Examples: Worked Article 30 EntriesWorked controller and processor RoPA entries for recruitment, payroll, customer support and marketing — what a complete Article 30 record looks like field by field.
Compliance GuidesEU AI Act Requirements in Ireland and the UKWhat Regulation (EU) 2024/1689 requires of Irish and UK organisations: risk tiers, deadlines, provider and deployer duties, Article 49 registration scope, penalties, and the GDPR overlay.
Compliance GuidesDPIA Requirements in Ireland and the UKWhen a DPIA is mandatory under GDPR Article 35 in Ireland (DPC) and the UK (ICO): the high-risk thresholds, required content, and prior consultation.
Compliance GuidesDSAR Requirements in Ireland and the UKHandling Data Subject Access Requests under the EU and UK GDPR: the one-month deadline, extensions, exemptions, ID checks, and DPC vs ICO practice.
Compliance GuidesData Breach Notification in Ireland and the UKThe 72-hour rule under Article 33, when you must tell affected individuals under Article 34, and how DPC and ICO breach reporting differ.
Compliance GuidesPECR & ePrivacy Requirements in Ireland and the UKCookie consent and electronic-marketing rules under UK PECR and the Irish S.I. 336/2011: consent, the soft opt-in, and DPC vs ICO enforcement.
Compliance GuidesWhat Is a DPIA? GDPR Article 35 GuideWhen a Data Protection Impact Assessment is required, what it should contain, and how DPIAs connect to RoPA and risk records.
AI GovernanceEU AI Act Ireland: 2026 Timeline and Article 50 GuideIreland AI Act implementation, Article 50 transparency obligations, and the evidence organisations should document now.
Compliance GuidesHow to Estimate Your GDPR Fine Exposure: A Step-by-Step GuideA practical walkthrough of Article 83 fine caps, aggravating and mitigating factors, and how to brief executives on realistic exposure.
Compliance GuidesDPIA Tools Compared: What Irish Organisations Should Look ForFive capabilities that separate an enterprise-ready DPIA platform from a spreadsheet-with-AI.
AI GovernanceWhy Acompli Is Built for Governance, Not Auto-DraftingAcompli is built on the principle that AI should be governed first and useful second. Every output is auditable, traceable, and human-approved.
Data StrategyThe Self-Reinforcing Data Lifecycle: Building Institutional KnowledgeEvery validated assessment is an input to the next — institutional knowledge compounds rather than decays.
Human FactorsThe Psychology of DPIA Completion: Why Experts StruggleWhy skilled privacy professionals still find DPIAs painful — and what the tooling has to change to help.
ProductivityAutomating the Administrative Burden: Intelligent Risk IdentificationHow pattern-matched risk surfacing lets assessors spend their time on judgement, not transcription.
Team ScaleAcompli Is Built to Scale the Privacy Function, Not Sideline ItThe platform expands what a DPO’s office can cover — rather than replacing the judgement calls only people can make.
Records & GovernanceGDPR RoPA Requirements in Ireland and the UKA side-by-side comparison of Article 30 obligations under EU GDPR and UK GDPR, with best practices for maintenance.
Data TransfersTransfer Impact Assessments under GDPR: Compliance GuideWhat the DPC and ICO expect in a TIA, how to document safeguards, and how to keep it current as suppliers change.
See these principles in the product
Run your first assessment with Acompli's AI drafting, human-review workflow and evidence-linked outputs.