Platform

Ten modules. One source of truth.

Each module writes to the same register, so evidence produced in one place is available everywhere else. Nothing is re-keyed and nothing drifts.

01 · Understand where you stand.

Gap assessment

Stop guessing whether you are compliant. The assessment engine asks plain questions about how your agency actually handles data, then returns a scored, prioritised roadmap.

Dynamic questionnaire that adapts to your agency profile.

Risk scoring across ten distinct compliance categories.

Step-by-step remediation ordered by risk and effort.

Client-ready PDF reports evidencing proactive compliance.

Take the assessment

ProducesArt. 24 · 32

A scored readiness figure and a dated finding list

Dynamic questionnaire that adapts to your agency profile.

Risk scoring across ten distinct compliance categories.

Step-by-step remediation ordered by risk and effort.

02 · Document your processing.

Records of processing

The cornerstone of the Regulation, without the spreadsheet. Maintain a living map of how data moves through your agency and your client projects.

Pre-built templates for common agency activities.

Vendors and systems linked to the activities that use them.

Lawful basis, retention period and data category per activity.

Article 30 records exported in seconds.

Start documenting

ProducesArt. 30

A versioned Article 30 register

Pre-built templates for common agency activities.

Vendors and systems linked to the activities that use them.

Lawful basis, retention period and data category per activity.

03 · Track your third parties.

Vendor intelligence

Agencies run on dozens of tools. Custodia tracks their compliance posture for you, drawing on a maintained profile for every common processor.

Hosting region, sub-processors and transfer mechanism per vendor.

Alerts when a vendor changes terms or discloses a breach.

One repository for every signed data processing agreement.

Risk assessed before you onboard a new tool, not after.

Explore the vendor register

ProducesArt. 28 · 44

A per-vendor transfer and DPA record

Hosting region, sub-processors and transfer mechanism per vendor.

Alerts when a vendor changes terms or discloses a breach.

One repository for every signed data processing agreement.

04 · Generate compliant notices.

Dynamic privacy notices

No generic templates, no drafting fees. Custodia generates privacy notices, cookie policies and terms from your actual processing records.

Notices update when you add a vendor or an activity.

Embeddable widgets keep published pages in sync.

Multi-language output for agencies working across the EU.

Language written for marketing and design agencies.

Generate a notice

ProducesArt. 13–14

A published, versioned privacy notice

Notices update when you add a vendor or an activity.

Embeddable widgets keep published pages in sync.

Multi-language output for agencies working across the EU.

06 · Handle data subject requests.

DSAR automation

Turn a twenty-hour scramble into a tracked workflow. Intake, identity verification and resolution are handled in one place against the statutory clock.

Secure, configurable intake portal for data subjects.

Identity verification before any data is gathered.

Collection tasks routed system by system.

Secure delivery of the finished data package.

Automate requests

ProducesArt. 15–22

A closed request file with a clock history

Secure, configurable intake portal for data subjects.

Identity verification before any data is gathered.

Collection tasks routed system by system.

07 · Respond to incidents.

Breach management

When it happens, speed decides the outcome. Custodia walks the 72-hour notification duty step by step so the response is defensible after the fact.

Incident response playbooks with named owners.

Severity assessed against EDPB criteria to decide notifiability.

Pre-filled supervisory authority notification templates.

An incident log that satisfies the breach register duty.

Prepare for incidents

ProducesArt. 33 · 34

A defensible incident record and 72h timeline

Incident response playbooks with named owners.

Severity assessed against EDPB criteria to decide notifiability.

Pre-filled supervisory authority notification templates.

08 · Assess high-risk processing.

Data protection impact assessments

Run the assessments the Regulation requires before a project launches, not after. Identify, evaluate and mitigate risk with a framework rather than a blank document.

Guided questionnaires built on regulator guidance.

Collaborative review with your DPO and stakeholders.

Risk matrix that orders mitigation by severity.

Exportable reports for prior consultation.

Start a DPIA

ProducesArt. 35

A signed-off DPIA with a measures register

Guided questionnaires built on regulator guidance.

Collaborative review with your DPO and stakeholders.

Risk matrix that orders mitigation by severity.

09 · Educate your team.

Employee training

Human error remains the largest privacy risk. Enrol your team in agency-specific awareness training and keep the completion evidence.

Short modules written for agency roles.

Automated enrolment and progress tracking.

Quizzes that verify comprehension, not attendance.

Completion certificates retained as evidence.

Train your team

ProducesArt. 39

Dated completion records per employee

Short modules written for agency roles.

Automated enrolment and progress tracking.

Quizzes that verify comprehension, not attendance.

10 · Prove compliance on demand.

Audit readiness

Turn compliance into something you can show a client. Generate a complete audit file or share a live trust page when enterprise procurement asks.

Public or password-protected client trust pages.

One-click generation of a complete evidence pack.

Answer vendor assessments from existing records.

One repository for every piece of compliance evidence.

Build a trust page

ProducesArt. 5(2)

An exportable evidence pack per request