Assessments that write your RoPA the moment they’re approved
Build your own questionnaire, send it to anyone who knows the answers, and let approved answers update your register, your documents and your task list.
Answer the questions, then approve as the privacy team.
Condition, due in 30 days
Due in 12 months
Saved to the RoPA’s documents
Build the assessment you need with every question your way
Question library
37 questions, 7 conditional. Numbers and references kept.
Flagged so you can fill it in. Nothing is lost.
Ask only what applies and skip the rest automatically
- Show questions based on any answerUse “is”, “includes” and “or” to bring in follow-ups only when they matter.
- Branch whole sectionsSeparate paths for controllers and processors, or for special category data.
- Conditions you can read“When Third parties is Yes”, not “When 3.1 is option 2”.
- A shorter form for respondentsReviewers still see why each question was or wasn’t asked.
Send it to anyone inside or outside your company
The person who knows how a process works often isn’t in your privacy tool. Pick who can answer each template.
Colleagues with an account
Assigned at launch. It shows up in their Assessments and Tasks, with register lists to pick from.
Vendors and outside experts
A personal link by email, no account needed. A 6-digit code on every visit keeps it to that person.
Anyone on your domains
One link for the whole business. Anyone with an email on your allowed domains can start an assessment.
An approved assessment isn’t a PDF in a folder. It updates your RoPA, files its own report and creates the follow-up tasks.
Approval does the paperwork register, report and tasks
| Field | Current | Proposed |
|---|---|---|
| Purpose | Online recruiting | Online recruiting, Background checks |
| Transfers | None | US, Standard Contractual Clauses |
| Retention | 6 months | 6 months |
| Department | HR | HR |
“Not sure” and “Not applicable” never overwrite a value already in the register.
Owner: Maria S. · due in 30 days
Owner: HR lead · due in 14 days
Due in 12 months, in the Assessments list
Stored on the RoPA’s Documents tab.
Help on the hard questions that gets better each time
A drafted answer, one click away
Turn on Ask AI for the questions people get stuck on. Respondents keep, edit or discard the draft.
Learns from earlier assessments
For re-assessments, Ask AI reads the last three assessments of the same RoPA, so suggestions start from what was answered before.
Questions we get asked
What is a privacy impact assessment (PIA)?
A privacy impact assessment (PIA) is a structured review of a processing activity: what personal data it uses, why, who receives it, where it goes, and which risks and safeguards apply. Teams use PIAs to check new or changed activities before they go live.
What is the difference between a PIA and a DPIA?
A Data Protection Impact Assessment (DPIA) is the assessment the GDPR requires under Article 35 when processing is likely to result in a high risk to people’s rights and freedoms. A PIA is the broader term, often used for every activity or as a first screening. In GDPR Register you can build both, including a DPIA screening based on the Article 35 criteria.
Can we use our existing PIA or DPIA questionnaire?
Yes. Import it and we keep your question numbers and source references, so past answers and comments stay attached to the right questions. Anything the import couldn’t read is flagged for you to fill in.
Do outside respondents see our register?
Only if you allow it. Register lists can be switched on or off separately for users, invited people and your organisation.
What happens if a respondent isn’t sure?
You can allow “Not sure” and “Not applicable” per question. Those answers never overwrite a value already in your RoPA.
Can the same activity be assessed more than once?
Yes. Run repeat assessments on the same RoPA, set a re-assessment period, and reviewers compare the current values with the proposed ones.
Do we have to use the privacy team review step?
No. Choose whether submitting completes the assessment or whether the privacy team approves it first.