Skip to main content
dpdprules.org
Data breached?
☰

Sources last verified on 17 August 2026. Methodology

Tool

One company compliance plan

Answer a few questions and get one organisation level action plan with owners, dependencies and official sources. Your role decides what you see first, never what the company owes. Answers and progress stay in your browser.

Loading your saved answers from this browser…

Plans are decided by the Compliance Plan rules pack, version 1. Identical answers always produce identical plans.

What this tool asks

  1. What should we call your organisation?Optional. Used only to label your plan on this device. It never leaves your browser.
  2. Does your organisation handle information about identifiable people?For example names, phone numbers, email addresses, delivery addresses, account details, photos or employee records. Customers, users, employees and vendors all count.
  3. Is any of that information handled on computers or phones?Includes information collected on paper and typed into a computer later. Spreadsheets, apps, email and cloud services all count.
  4. Where does your organisation operate?
  5. Is this information handled only by one individual for personal or family matters?For example a personal contact list or family photo collection. Answer no if any of it is for business, work or an organisation.
  6. Can people under 18 use your service or appear in your data?
  7. What is your role, so we can show your work first?This only changes the ordering and framing of results. The organisation's obligations stay the same whoever is reading.

The company actions the plan draws from

  • Map what personal data you hold and why
  • Draft the standalone plain language notice
  • Ship consent withdrawal and complaint paths
  • Implement the minimum security safeguards
  • Put safeguard terms in processor contracts
  • Build the breach response runbook
  • Stand up the Board intimation process
  • Design the retention and erasure schedule
  • Build erasure timers and the forty eight hour warning
  • Publish the contact for processing questions
  • Publish rights request channels and identifiers
  • Stand up grievance handling within a published period
  • Support nomination in your rights flow
  • Build verifiable parental consent for children
  • Verify lawful guardians where they consent for others
  • If notified as significant: annual assessment and audit cycle