Platform
One record of your programme, from the law to the evidence.
Regulator readiness, the data map, rights requests, breaches, assessments, vendors, consent, policies, training and the Inspection Pack, connected in one workspace.
- Built on each country's law
- Evidence you can prove
- One connected record
Office of the Data Protection Commissioner
Kenya Data Protection Act, 2019
+9 pts since last month
What an inspector would find first
- KEN-004Keep a record of processing activities1/2 evidenced
- KEN-012Notify personal data breaches0/2 evidenced
- KEN-013Safeguard transfers outside Kenya0/1 evidenced
See
Regulator Readiness
Your home screen is one card per regulator you answer to, with the gaps an inspector would find first.
- Programme readiness: evidenced tasks against required tasks, weighted by importance
- Operational health: live work closed on time, kept separate so handling more requests never lowers your score
- Readiness drops when evidence expires, so the number stays honest between audits
See
Today
One queue for all compliance work, ordered by what is overdue, what has a legal clock and what is due this week.
- Add evidence and finish work without leaving the queue
- Reviewers see what is waiting for them first
Record
Data Map and record of processing
Systems, vendors, data elements and processing activities, recorded once and linked. Your record of processing is a view of the map, not a separate spreadsheet.
- Sensitive data raises a DPIA; legitimate interests raises an LIA
- Systems or vendors abroad raise transfer safeguards; processors without a contract raise a DPA
- Export the record of processing as CSV or in the Inspection Pack
You record
Staff biometric attendance
- Data
- Fingerprint templates
- System
- CloudHR, hosted in Ireland
- Vendor DPA
- Not signed
Respond
Rights requests and the Data Subject Portal
A public page where people ask to see, correct or delete their data, with a private link to follow progress. Requests by WhatsApp, phone or in person run on the same clock.
- Deadlines follow the law of the entity's country
- Identity must be verified before data is released
- The response is stored as evidence; consent withdrawals update the consent ledger
Respond
Incidents and breaches
A breach register with a live clock from the moment the organisation became aware.
- Advisory recommendation on whether to notify, with the reasons
- The DPO records the decision and rationale, which is what an inspector reads
- Notifying the regulator raises its own task until the acknowledgement is recorded
Assess
DPIAs, LIAs and transfer assessments
Structured assessments with a likelihood-and-severity risk matrix, started from the task that asked for them and pre-filled from the Data Map.
- Approval locks the assessment and evidences the task
- Separation of duties is recorded when a preparer also approves
Assess
Vendors and the Vendor Portal
Send a processor a single-use link. They answer ten due-diligence questions without an account; you review and set their risk.
- Missing breach-notice or DPA commitments make a vendor high risk regardless of score
- Systems they host inherit their transfer obligations
Record
Consent ledger
Every consent event is a new entry, so you can prove what someone agreed to on any date.
- Capture on web, paper, WhatsApp, SMS or verbally, with the notice version
- Bulk import digitised paper forms from CSV
Govern
Policies
Templates for the policies regulators ask for, versioned and hashed. Approving a version seals it and evidences the tasks it satisfies.
- See exactly which version was in force on any date
Govern
Training
A course builder and library, quizzes marked on the server, and points, levels and badges that keep people coming back. Staff who only need training see nothing else.
- Certificates with a QR code anyone can verify
- Mandatory courses assigned to new joiners and renewed each year
- Completion, overdue learners and knowledge gaps per person
Prove
The Inspection Pack
Everything an inspector asks for, in one document, as it stood on the date you choose.
- Controls with their evidence index and hashes
- Record of processing, processors and transfers
- Rights-request log, breach register, approved assessments and training record
- A fingerprint of the pack and the audit trail's head hash at that date
Prove
Audit trail
Every action is attributable and hash-chained to the one before, and the chain is verified in the app.
- Evidence files are stored by their SHA-256 hash and can't be swapped after upload
See it on your own data.
We set hlola up for your country before the call, so you see your own readiness, not a sales deck.