Every privacy questionnaire answered from today's record of processing, each answer cited, with the DPO deciding every gap
Every answer traced to the record of processing, and no transfer gap reaches a customer.
See one case, screen by screen ↓Privacy questionnaire software for the company that receives them: it answers customers' privacy and DPA due-diligence questionnaires from your record of processing, sub-processor register and the customer's signed DPA, each answer cited. Seven agents read, trace, draft and check every transfer mechanism and commitment, and the DPO decides the gaps and signs before the answers go back in the customer's own file.
How to choose AI solutions for back-office and enterprise work →
Updated
Under GDPR Art. 28 a processor must give each customer "sufficient guarantees" and make available all the information needed to show compliance, and since EDPB Opinion 22/2024 that means the full sub-processor chain, accurate at all times. So a privacy questionnaire arrives with every renewal: a processor due-diligence questionnaire from an insurer's vendor-risk team, an Art. 28 questionnaire in German from a hospital, a CPRA service-provider questionnaire from a retailer. They ask the same hard things: which data, for which purpose, kept how long, with which sub-processors, in which countries, under which transfer mechanism.
A privacy analyst answers them from last quarter's answers, searching the record of processing, the sub-processor list and the DPA, and chasing activity owners and counsel by email. The record has moved on since. A US sub-processor's Data Privacy Framework certification lapses unnoticed, an answer says 24 hours when the signed DPA says 48, and one customer is told service logs are kept 30 days while another is told 90. Each of those reaches the customer with the DPO's name on it.
Estimated split for a 140-question privacy questionnaire, by hand and with the solution.
Seven agents trace, draft, check transfers and commitments, and route every question; the DPO decides the gaps and signs.
Norrvik Mutual Assurance's vendor-risk team sends Kestrel & Vane Services its processor due-diligence questionnaire for 2026: 140 questions for the renewal of the Field Service Platform, a €2.4M deal due back on Fri 23 Oct. Here is how the DPO and her team work with the agents on it, screen by screen, in the working solution.
Henrike's home shows four numbers — 6 open questionnaires, 3 waiting for her, 1 transfer gap, a 2.6-day median turnaround — and what needs her. Beside them is the agents' thread. The Transfer Checker reports its 06:00 check: 11 transfers outside the EEA, Brightquay Analytics still inactive on the DPF list. The Gap Router says her decision on Norrvik G.3 is due at 09:21, with three options ready.
Gap Router: “Your decision on Norrvik G.3 is due at 09:21. I have three options ready, with sources.”
Dev Kalra, the sales engineer, drops in Norrvik's workbook. The reader opens its three tabs and a hidden one, finds 140 questions in 11 sections, maps 140 answer cells and 84 Yes/No cells, finds the closest past questionnaire (Norrvik 2025, 61% the same) and checks the cells for hidden instructions. Then it asks one question in the thread: which service is in scope? It recommends the Field Service Platform, as the cover tab says.
Questionnaire Reader: “Give me the customer's file, link or email. I find every question, the cell its answer goes in and any Yes/No column. I never change their file.”
The Records Tracer traces all 140 questions to 8 processing activities, 19 data flows and 9 sub-processors. The Answer Drafter writes 140 answers with 412 citations from that trace and Norrvik's signed DPA NMA-DPA-2023 v2.1. The Transfer Checker checks all 19 data flows, 3 of which leave the EEA, the Commitment Checker finds 4 asks beyond the DPA and 2 answers that differ from the past, and the Gap Router routes 7 questions to people.
Gap Router: “Drafting is done: 118 ready, 15 to confirm, 7 for a person. For you it is G.3, a transfer gap.”
G.3 asks for every sub-processor in a third country with its transfer mechanism. The trace runs across five lanes: the question, the 4 processing activities it touches, 5 data flows, the sub-processors and each mechanism. Tallis Support Services in India has SCC 2021/914 Module 3 and a TIA reviewed 3 Nov 2025. Corvane Cloud Services Inc. has the EU–US DPF plus SCCs as fallback. Brightquay Analytics, for usage analytics, shows red: not current.
Transfer Checker: “Brightquay Analytics relies on the DPF only. Its certification has been inactive since 31 Aug 2026, and no SCCs are on file. I can't call this transfer covered.”
Henrike clicks Brightquay's mechanism. The source opens beside the trace: the Data Privacy Framework list entry, checked by the Transfer Checker on Monday at 09:19 and again on Tuesday at 06:00, with the passage it relied on highlighted, and buttons to open it in the source system or copy it with its reference.
“Participation status: Inactive. Certification due: 31 Aug 2026 (not renewed).”
Before she decides, Henrike asks the agents in plain words. The Transfer Checker answers with citations: the register names the DPF as Brightquay's only mechanism, and the contract repository holds SCC Module 3 for Corvane and for Tallis, but none for Brightquay. Counsel could sign Module 3 with them in about 3 days, and the Transfer Checker has drafted it for Tomás.
Transfer Checker: “There isn't one for Brightquay.”
Three options: A, disclose with remediation (recommended); B, remove Brightquay before answering, which needs a sub-processor notice under DPA §7.2; C, hold G.3 for privacy counsel. She picks A with reason code TRF-GAP-DISCLOSE. The answer names all three sub-processors, Brightquay's processing of Norrvik data is paused from today, counsel task T-2291 goes to Tomás Lindqvist-Ferreira for SCC Module 3, due Fri 16 Oct, and the 11 corrections are queued for her approval.
“The Transfer Checker could not confirm a current mechanism. The Gap Router recommends option A.”
Ripple searched 9,840 past answers for statements that depend on Brightquay's mechanism and found 11 customers who, since 31 Aug, were told that all transfers to the United States are covered by the EU–US Data Privacy Framework. It drafted a correction and a notice for each, and a change to the trust centre's sub-processor page. The Commitment Checker reconciled E.3: Norrvik is told service logs are kept 90 days under retention schedule RS-04 v6; Aldermoor Rail was told 30 under v5, so a short correction is drafted.
Commitment Checker: “Both answers were right on their day. Aldermoor's is now out of date and is still open in their supplier file.”
The sign-off pack shows 7 of 7 checks: every question answered, every answer cited, every answer reviewed, every decision made, transfers checked today, nothing promised beyond the signed DPA, consistent with past answers. She approves the last 14 ready answers in one step with reason SRC-OK, then signs with reason DPO-APPROVE, ticking that she has reviewed the 7 decisions and the transfer disclosure, and typing her full name.
“Your name, the reason and the time are written to the audit trail.”
The Return Packager writes 140 answer cells and 84 Yes/No cells into Norrvik's own file, compares the other 3,412 cells and changes none. The evidence pack holds the sub-processor list with addresses and contacts, the record of processing extract, the SCC Module 3 extracts and the ISO/IEC 27001 certificate; the SOC 2 report and pen-test summary go only because an NDA is on file. It went back 10 days before the due date.
Cell check: 140 answer cells written · 84 Yes/No cells written · 0 other cells changed.
The same questionnaire, seen by the five people who carry it — what their week looked like, and what it looks like now.
Seven agents trace, draft, check transfers and commitments, and route every question; the DPO decides the gaps and signs.
Reads the customer's questionnaire in any format — Excel, Word, PDF, a portal page — and finds every question, its section, the cell its answer goes in and any Yes/No column. It compares the file with past questionnaires and checks the cells for hidden instructions.
Maps each question to the processing activities, data flows, sub-processors and transfer mechanisms it touches in the record of processing for the service in scope, with the source row for each step.
Writes each answer from the trace, this customer's signed DPA and current policies, with numbered citations and a confidence.
Checks every flow that leaves the EEA on the day: DPF list status and certification date, SCC version and module, TIA review date and the UK Addendum. It runs every day at 06:00 and on every questionnaire.
Compares each answer with this customer's signed DPA, not the template, and with what other customers were told, showing both sources when they differ.
Routes each gap and commitment to its named owner with options, a recommendation, the sources and a clock. With Ripple it finds every past answer and customer that said the opposite and drafts the corrections.
Writes each approved answer into its cell in the customer's own file, proves every other cell is unchanged and assembles the evidence pack allowed for this customer.
Decides the gaps, signs every return. The agents propose; a named person decides.
Ask the agents in plain words, or tell them what to draft. Every answer points to its source, and nothing goes to a customer until the DPO signs.
Which customers were told all US transfers are covered by the DPF?
11 customers, in questionnaires returned between 3 Sep and 9 Oct 2026, were told "all transfers to the United States are covered by the EU–US Data Privacy Framework". Brightquay's certification lapsed on 31 Aug, so each of those answers is now wrong for usage analytics. A correction is drafted for each one, for your approval.
Show every third-country sub-processor and its transfer mechanism
For the Field Service Platform there are 3: Corvane Cloud Services Inc. (US), DPF active with SCC Module 3 as fallback; Tallis Support Services (India), SCC Module 3 with the TIA reviewed 3 Nov 2025; Brightquay Analytics (US), DPF lapsed, no fallback.
Draft the notice to Norrvik about pausing Brightquay
Draft: "The Data Privacy Framework certification of our sub-processor Brightquay Analytics LLC lapsed on 31 Aug 2026. We have paused Brightquay's processing of your data from 13 Oct 2026 and are signing SCC 2021/914 Module 3 with them. We will confirm in writing within 5 working days, as DPA §7.6 requires." Saved to Decisions for your approval. Nothing has been sent.
What does Norrvik's DPA say about breach notification?
DPA NMA-DPA-2023 §9.1: without undue delay and in any event within 48 hours of becoming aware. The questionnaire asks for 24 hours (J.4). Tomás Lindqvist-Ferreira decided on Monday to keep 48 hours, reason code DPA-CEILING.
13 screens from the working solution, on its sample data. Pick one to see it large.
Who decides what, how sure an answer must be and how fast people must answer are settings. Every change is a new version, logged with the name of the person who made it.
| Setting | Default | Choose from |
|---|---|---|
| Ready for approval at or above | 85% confidence | Any value from 70% to 98% |
| Needs a person below | 60% confidence | Any value from 40% to 80% |
| A transfer without a current mechanism | Goes to the DPO · TRF-GAP | On · Off |
| An answer that promises more than the signed DPA | Goes to privacy counsel · DPA-CEILING | On · Off |
| Any question about training AI or models | Goes to privacy counsel · AI-NO-TRAIN | On · Off |
| Certifications older than 12 months | Off | On (to security GRC) · Off |
| Decision clocks | DPO 24 · counsel 48 · security 48 hours | Set per role, in hours; warning 3 days before the due date |
| Notify by | Email and Microsoft Teams | Email · Microsoft Teams · Mobile push for SLA breaches |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (IAPP survey: vendor and third-party assessments run by 78% of US respondents; a €290M fine by the Dutch data protection authority, Aug 2024). Regulatory context: GDPR Art. 28(1), 28(3)(h), 28(4); EDPB Opinion 22/2024 (adopted 7 Oct 2024); Commission Implementing Decision (EU) 2021/914. People, companies, sub-processors and contracts named on this page are fictional — characters and sample data in the working solution.
Privacy questionnaire software for the company that receives them: it answers customers' privacy and DPA due-diligence questionnaires from your record of processing, sub-processor register and the customer's signed DPA, each answer cited. Seven agents read, trace, draft and check every transfer mechanism and commitment, and the DPO decides the gaps and signs before the answers go back in the customer's own file.
The Records Tracer maps each question to the processing activities, data flows, sub-processors and transfer mechanisms it touches in the live record of processing, and the Answer Drafter writes the answer from that trace with numbered citations. Every step of the trace opens its source row, so an answer is rebuilt from today's record rather than copied from last quarter's.
The Transfer Checker checks each third-country flow on the day: DPF list status and certification date, SCC version and module, TIA review date. If it cannot confirm a current mechanism, it refuses to call the transfer covered and the Gap Router hands the decision to the DPO with options, sources and a 24-hour clock. Ripple then finds every customer who was told otherwise.
No. The Commitment Checker compares each answer with this customer's signed DPA, not the template. When a question asks for more — 24-hour breach notice when the DPA says 48 — the DPA wording is kept and the question goes to privacy counsel with the clause and a recommendation.
Excel, Word and PDF files, customer portals and questionnaires forwarded by email. The answers are written back into the customer's own file: in the sample, 140 answer cells and 84 Yes/No cells were written and none of the other 3,412 cells changed.
Yes. The agents draft, check and recommend; they never decide a gap, sign or send anything to a customer. The DPO decides transfer gaps, counsel decides commitments beyond the DPA, security answers key and testing questions, and the DPO signs every return and approves every correction, each with a reason code on the audit trail.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your record of processing, sub-processor register, signed DPAs and past questionnaires — and it goes live once every quality gate has passed. Roles, thresholds, routing rules and clocks are then settings your privacy operations lead owns.
The target is 2–3 working days for a 140-question privacy questionnaire, against 2–3 weeks by hand. In the sample, the agents drafted all 140 answers in 7 min 40 s, and the signed questionnaire went back 10 days before its due date.
Questionnaires back in days, not weeks, and every answer matches what customers were told.
1-min demoRFP Response AutomationHigher win rate, no promise you can't keep, and the bid in on time.
1-min demoDue Diligence Questionnaire (DDQ) ResponseEvery DDQ answered from approved sources, and no investor told two different stories.
1-min demoWe'll run Privacy Questionnaire Response on one of your own past questionnaires, against your record of processing.