Every screen, step by step.

Open the assessment — no sign-in is asked for.

Answer the 28 questions about your sector, data and users; every question saves as you go, so you can leave and resume.

Read your result: whether the Act applies, your likely role, the Significant Data Fiduciary indicator, and a sequenced roadmap.

Sign in when you want to keep it — the roadmap attaches to your new workspace and is filed in your Document locker as a Word report.

Read the programme map first — one labelled tile per obligation area: green is assessed and healthy, amber carries its open-gap count, hollow simply has not been assessed yet. No fake percentages. The same journey rides under the header on every page as seven numbered stations — click one to unfold its tree of modules and registers, with the page you are on highlighted.

Check the attention strip: overdue and due-soon items across all live registers, each one click away.

Navigate with the journey bar under the header — the same seven stations on every page. Click a station to fan out its modules and registers; the page you are on shows as a solid blue chip.

Follow the "do this next" card when unsure; it always points at the FIRST unfinished stop in walking order — even if that means going back a step you skipped past. Each stop builds on the ones before it.

Click the workspace name in the header and choose Workspace settings. Owners manage members and destructive actions; members do everything else.

Invite by email and pick a role — the invitation only works for that exact address, and can be sent by email or shared as a link.

The invitee signs in with their own Google account and accepts; the workspace becomes their active one.

The active workspace always shows beside your avatar — belong to several and the same menu switches between them, so nothing is ever filed into the wrong organisation.

Open station ② Map on the journey bar and click "Map your data".

Add each processing activity: what data, whose, the purpose, and the lawful basis. Starter sets prefill the usual suspects — edit rather than start blank.

Answer the assessment questions that follow; pick "Not sure — we haven't checked yet" honestly where true.

Submit to lock the baseline. The inventory becomes the reference every other module reads.

Grade each question about how you notify and take consent today.

Paste your real privacy-notice text into the readability checker — it scores plain-language compliance and suggests the grade.

Attach evidence (your live notice, consent screenshots) where the question offers an upload.

Submit, then open the consent ledger to start recording consents against notice versions.

Answer the seven control questions; each names the exact Rule 6 safeguard it tests.

Upload evidence (a security policy, a config export) — the optional AI review can suggest answers from it.

Read the maturity report: your score, each gap, the answer you gave, and the compliant target.

Fix the ambers first — gaps here sit at the top of your remediation plan.

Say whether minors can be in your data at all — the module sizes itself to your answer.

Grade how you verify age and take verifiable guardian consent.

Confirm no behavioural monitoring or targeted advertising is directed at children.

Check the Fourth Schedule exemptions if you are a clinical, educational or childcare setting.

Assess whether your systems could receive, act on and honour a consent given through a Consent Manager.

Grade withdrawal handling — a withdrawal through a Consent Manager must work end to end.

Note the gaps; interoperability obligations arrive with the consent-phase dates.

Walk the designation factors: volume and sensitivity of data, risk to Data Principals, and the other § 10 factors.

Read your indicator band — low, medium or high.

If medium or high, open the DPIA and SDF audit modules next; those duties arrive with designation.

Open station ⑥ Run on the journey bar and click "Operations board".

Read the pulse strip: overdue, due soon and open items across every register.

Work the inbox top-down — it is one prioritised list across all statutory clocks.

Use the lanes — requests, incidents, records, cadence — to jump into any register.

Log each request as it arrives — channel, identity verification, what is asked. The 90-day clock starts itself. Arriving with a spreadsheet? Import it as CSV.

Share your public intake link (or embed it on your site) — portal submitters get an acknowledgement and a tracking link to check their own status.

Work the queue: the register sorts by deadline, and overdue rows go red on the dashboard.

Close each request with an outcome note — the requester sees it on their tracking page, and the register keeps it as your Rule 14 evidence.

Log the incident the moment you become aware — the 72-hour Board clock starts from awareness, and the register starts it for you.

Record who was notified: affected Data Principals without delay, the Board intimation, containment steps.

Generate the Rule 7 Board report as a Word document straight from the incident.

Close with root cause and remediation — closed incidents stay as your evidence trail.

List each dataset with its retention basis and erase-by date.

Watch the register: items nearing their date surface on the dashboard before they become findings.

Mark datasets erased when done — date-stamped, so you can prove deletion later.

Add every processor — hosting, payments, email, support — with purpose and location.

Record the data-processing agreement status and attach the signed DPA.

Set the next review date; the calendar nags you when oversight falls due.

Record each transfer route: destination country, recipient, data categories, purpose.

Note the safeguards on each route — contractual clauses, encryption, hosting terms.

Watch the restricted flag: destinations the Government restricts are marked on the register.

Log each grievance with its channel and subject — the redressal clock starts on receipt.

Track progress; overdue grievances surface on the dashboard.

Record the resolution — after your process, a Data Principal may escalate to the Board, and your register is the story you tell.

Add each notice and policy with its version, languages and effective date.

Attach the actual document to every version.

Set review dates — the calendar surfaces them; retire versions rather than deleting, so the ledger can point at them.

Add each recurring obligation with its due date and cadence.

Export to your own calendar (ICS) so deadlines live where you already look.

Mark items done — completed cycles are evidence that the programme runs, not just exists.

Record your DPO (or data-protection contact), grievance officer and auditor.

Mark each as published where the Act requires contact details to be reachable.

Keep appointment dates — auditors ask who was accountable, since when.

Open station ⑦ Prove on the journey bar and click "Proof shelf".

Check each tile: what it is, whether it is ready, and what it draws on.

Download what the moment needs: the vendor questionnaire pack for a customer, the compliance dossier for auditors, the complaint response pack when a specific person is named.

Come here any time — proof does not wait for the programme to be finished.

Open Prove → Evidence ledger. Everything the registers handle is already here — each entry with its citation, source, operator and hash.

Look a person up with their exact email or phone (identities are stored only as salted hashes — the identifier arrives with the complaint anyway).

Generate the complaint response pack: duty-by-duty summary with the clock arithmetic, the full timeline, and honest "no record found" gaps.

Record evidence manually for acts outside the registers — paper consent, a phone-handled request — or append a correction; nothing is ever edited.

Describe the processing activity and its necessity.

Weigh the risks to Data Principals and record the mitigations.

Record the residual risk you accept and set the review date — the DPIA is a living document.

Walk the audit-scope questions to see what the auditor will ask for.

Gather the evidence each answer points at — registers, policies, reports already in your workspace.

Track findings to closure and keep the trail current between audits.

Complete at least one assessment module first — the analysis reads their answers.

Review every open gap, ranked by severity and penalty exposure.

Assign each gap an owner and a target date with "Work this" — open remediation shows on the Run board until it is closed with a note of what changed.

Open the locker from the briefcase icon in the header — it works from every page.

Find your documents grouped by kind, every version kept: templates, board decks, assessment roadmaps.

Download any version again; nothing is ever regenerated or silently changed.

Pick a template — notices, DPAs, breach playbooks, each cited to the clauses it serves.

Fill the placeholders; your organisation profile prefills the common ones after the first time.

Generate the Word document — it lands in your Document locker, versioned.

Choose your build path: answer six quick questions, or start from your applicability results.

Pick your goals — the deck shapes its ask around them.

Download the PowerPoint: cited evidence, a drawn statutory timeline, speaker notes you can read aloud.

Signed in, every deck and its answers are filed in your Document locker automatically.