Create and manage your records of processing activities per Art. 30 GDPR. AI does the heavy lifting – descriptions, mandatory fields and TOMs are suggested automatically for individual sections. Import existing records as DOCX or XLSX, or have a new processing activity generated from a task description. All systems, information obligations and processing activities centrally documented – in 25 languages for interface and documents, with optional automatic translation.
Records of Processing
AI completes a processing activity or revises it in full: purpose, data categories, data subjects, legal bases, recipients, third-country transfers and retention periods. You confirm or adjust – no tedious typing, no empty fields. The result: a complete Art. 30 record in a fraction of the time.
Data Processing Systems
Manage all data processing systems with provider details, data categories and TOM links centrally. Protective measures can optionally be adopted from linked data processing systems. The result is a seamless connection between processing and protective measures.
Information Obligations
Record all relevant details of information obligations in a structured manner. Group multiple information obligations into publication groups and publish them via permanent link or snippet on your website. Changes are applied automatically.
Features
From AI-assisted creation through revisions to collaboration – all the tools for a complete record of processing activities.
The form guides you through all mandatory fields and shows AI suggestions. Data categories, legal bases, recipients and retention periods are suggested based on the type of processing.
All processing activities centrally in a filterable overview. Status, responsible persons, legal basis and last update at a glance.
Once a processing activity is approved, the system automatically creates a PDF revision. Traceable history of all approved versions – available at any time. Two revisions can be compared visually with color-highlighted changes (additions green, removals red). Stored SHA-256 checksums make the integrity of each revision verifiable, detecting any subsequent tampering. Comparison and integrity verification are available for revisions created from the introduction of this feature onwards; older revisions cannot be compared or verified retroactively.
Activity log, file attachments, tasks, comments, checklists and tags. Content can be carried over from linked documents – ideal for cross-tenant standardization.
Group multiple information obligations together and publish them jointly via a permanent link.
Information obligations are linked to the affected processing activities. Relevant information is automatically carried over.
The AI enriches and revises individual sections of your processing activities – optionally including a threshold analysis for a structured assessment.
Determine the protection needs for the protection goals confidentiality, integrity and availability via a damage-scenario matrix following the maximum principle. Linked systems are taken into account including the accumulation effect – either manually or AI-assisted. The protection needs assessment can be exported as PDF or DOCX (summary with overall protection need, damage scenario matrix and inherited sources). The protection needs are visible and filterable in the overview table and included in the list exports.
Every document displays its links in the "Relationships" tab as a graphical overview – the document at the centre, all connected areas visibly linked to it. Counters additionally indicate how many linked entries are inaccessible to the respective user.
The "Contract relationships" section shows the data recipients of each processing activity and the data processing agreements covering them – in combination with the Contract Management module.
FAQ
Yes. The structured form guides you through all mandatory details – purpose, data categories, affected persons, legal bases, recipients, third-country transfers, and retention periods – and AI completes the details or revises them in full. Existing records can be imported as DOCX or XLSX, or derived from a task description. On approval the system creates a PDF revision; two states can be compared visually and verified for integrity via stored SHA-256 checksums.
No. Text modules for recurring content are included. And wherever your processes go beyond that, AI creates new processing activities from your own material: existing records can be imported as DOCX or XLSX or derived from a task description – the suggestions are reviewed in a preview and confirmed by you.
Yes. For the record under Art. 30(2) GDPR there is a separate area, processing activities on behalf of a controller, covering responsibilities, a description of the processing, details of data transfers and technical and organizational measures. You generate this record as a PDF or DOCX report as well. Together with the contract management module, the contract relationships section shows the data recipients and the contracts that cover them.
You document each system once, with vendor details, data categories, recipients and safeguards, and link it to the processing activities that run on it. Safeguards can be taken over from linked systems, and every system shows the processing activities assigned to it. You can arrange systems hierarchically into parent and child systems and map the data flows between them.
Using a damage scenario matrix for the protection goals of confidentiality, integrity and availability, either manually or with an AI suggestion. The result is passed on to the linked data processing systems according to the maximum principle, where linked systems and the cumulation effect are taken into account. Protection requirements are visible and filterable in the overview table, and you export the assessment as PDF or DOCX with the overall requirement, the matrix and the inherited sources.
You do. The AI features are optional: the AI completes a processing activity or revises it in full, and when importing or suggesting new processing activities you review the results in a preview and choose what to take over as a draft. The approval is yours to give. Every AI activity is logged with function, user, model and status. That way the record is built with AI and your team.
You generate the record as a PDF or DOCX report, and you can also create case files for individual processing operations. Every approval produces an immutable revision, so you can evidence earlier versions too. The activities tab shows who changed what and when, and the revision comparison highlights the differences between two approved versions in color.
In 30 minutes we will show you how preeco | data protection makes your records of processing activities per Art. 30 GDPR complete.