Custodian GRC. The Cyber and Data Protection Act, in working order.

Every module ships on every plan. Compliance is not a paywall.

The CDPA and SI 155 require these modules. We refuse to gate them. What differs by plan is conventional levers: seats, integrations, audit-log retention, and branding.

• RoPA

  CDPA s.18 · SI 155 r.7

  Records of Processing Activities

  A living record of every processing activity, with controllers, processors, lawful bases, and retention periods queryable from one place. Generates the export the regulator asks for.

• DPIA

  CDPA s.18(7) · SI 155 r.10

  Data Protection Impact Assessments

  Triggered DPIAs for high-risk processing, with a structured assessment, mitigations, and a decision record. Reviewable by the DPO, signable, and exportable to PDF.

• Form DP3

  CDPA s.19 · SI 155 r.16

  Breach reporting

  Incident triage, severity scoring, the 72-hour clock, regulator notification on Form DP3, and customer notification copy. The audit trail is the timeline.

• Form DP2

  CDPA s.18(2) · SI 155 r.6

  DPO management

  DPO designation, the 14-day Authority-notice clock, and the artefact a controller files with POTRAZ. Renewals and changes track in the same register.

• Form DP1

  SI 155 r.4 · §4(5)

  Data controller licensing

  POTRAZ-tier-aware licence application: Tier 1 through Tier 4, with the right fee schedule and the supporting evidence the Authority requests.

• Processor register

  CDPA s.27 · SI 155 r.13

  Vendors and DPAs

  Processor register, DPA template, transfer assessments, and renewal calendar. Sub-processor changes are tracked, not assumed.

• Public notice

  CDPA s.13 · SI 155 r.9

  Privacy notice generator

  A privacy notice generator that reads from the RoPA, so the public-facing notice and the internal record do not drift apart on the next audit.

• Special category

  CDPA s.16 · SI 155 r.11

  Children’s data

  Age verification, guardian consent capture, and the additional safeguards required when processing data about subjects under 18.

• Lifecycle

  CDPA s.18(4) · SI 155 r.14

  Retention scheduling

  A retention schedule that runs as code: rules per data class, automated review prompts, and the audit log of what was disposed and when.

• Internal report

  CDPA s.20 · PECG Act

  Whistleblower channel

  A confidential channel for staff to raise concerns, with role-isolated triage and a record auditors can verify without seeing the underlying data.

• Sector code

  CDPA s.30

  Code of conduct

  Sector codes of conduct supported as first-class artefacts, with controls inherited and the differences from the base CDPA framework called out.

• Transfer register

  CDPA s.28 · SI 155 r.15

  Cross-border transfers

  Adequacy assessments, standard contractual clauses, and a transfer register that survives the next change to the Authority’s adequacy list.

• Operational risk

  RBZ Op Risk · IPEC

  Risk register

  A risk register tied to the controls themselves: a risk maps to the control that mitigates it, the evidence behind it, and the owner accountable for the next review.

Engineered to fit your stack, not the other way round.

• Single Sign-On

  Microsoft Entra ID, Google Workspace, and Okta on the Enterprise plan. SAML 2.0 and OIDC supported.

• SCIM provisioning

  Auto-sync users and group memberships from your identity provider. Joiners, leavers, and role changes propagate inside one cycle.

• API and webhooks

  A public REST API and outbound webhooks. Pull RoPA exports into your data lake, push compliance events into your SIEM.

• White-label and CNAME

  Branded domain, branded login, and exportable artefacts that read in your house style for parastatals and group operators.