Data Protection

Create and manage processing activities through a guided 7-step wizard covering purpose, legal basis, data subjects, data categories, retention, and transfers. Each activity follows a four-state workflow: Draft, In Review, Approved, Needs Update, with full audit logging. Link activities to assets, third parties, and controls so every dependency is traceable. Multi-framework support means GDPR and Swiss FADP fields coexist on the same record, with framework-specific attributes shown conditionally.

Extend your asset inventory with privacy-specific attributes: data classification, personal data categories, data elements, and hosting relationships. A personal data grid shows which elements each asset processes, and linking assets to processing activities creates a bidirectional traceability chain from business purpose to technical system.

See how personal data moves across your organisation in an interactive diagram. Custom nodes represent processing activities, assets, and third parties; automatic graph layout arranges the diagram; and clicking any node navigates to its detail view. The visual makes it practical to explain data flows to regulators, auditors, and business stakeholders without drawing slides from scratch.

Track privacy-relevant attributes on every third party: DPA execution status, processing role (controller, processor, joint controller), data transfer countries, and applicable transfer safeguards. Third parties link back to the processing activities they support, so when a DPA expires or a transfer mechanism changes, affected activities surface immediately.

A purpose-built dashboard gives DPOs and compliance leads a live overview: processing activity status distribution (donut chart), data inventory coverage, third-party DPA status, and framework assignment completeness. Four compact KPI cards highlight what needs attention without opening individual records.

A structured 11-step import process brings your existing OneTrust data into Acuna: processing activities, assets, third parties, personal data mappings, and framework assignments. Dry-run mode validates the import before committing, and a post-import checklist confirms data integrity. The migration path is designed to eliminate the need for parallel systems during transition.

The module ships with GDPR and Swiss FADP pre-configured. Each processing activity can be assigned to one or both frameworks, and framework-specific fields appear conditionally. Additional frameworks like UK-GDPR and LGPD can be added through compliance programme configuration.

Processing activities connect to primary assets (where data is collected), supporting assets (where data is stored or processed), and third parties (where data is sent). These relationships form a traceability chain: purpose, collection, storage, transfer. Each link is visible in both the activity detail view and the data flow diagram.

The data flow diagram renders processing activities, assets, and third parties as interactive nodes with directional edges showing data movement. Layout is automatic. You can click any node to navigate to its detail record. The diagram is useful for Article 30 documentation, regulator conversations, and internal data mapping exercises.

Yes. The OneTrust import follows an 11-step process covering lookups, assets, third parties, processing activities, personal data mappings, and framework assignments. A dry-run mode validates everything before committing. The import has been validated against production OneTrust exports with over 1,800 personal data rows.

Each third party carries privacy attributes: DPA status (not started, in progress, signed, expired), processing role, data transfer countries, and transfer safeguards. These attributes appear on the third-party detail view and link back to every processing activity the third party participates in.

Phase 2 will add Data Subject Access Requests (DSARs) with workflow and SLA tracking, Data Protection Impact Assessments (DPIAs) linked to processing activities, breach notification workflows with regulatory deadline tracking, consent management with purpose registers, and safeguard-to-control traceability for third parties.