# DPO Central

Privacy program management for CCPA, US state laws and GDPR. Built by TODO.LAW.

Address: https://dpocentral.todo.law · Spanish: https://dpocentral.todo.law/?lang=es · Documentation: https://dpocentral.todo.law/docs

## What it does

Use the setup wizard to put together a privacy program in minutes: select your industry and top vendors. You can migrate it to other hosting alternatives or to an enterprise platform at any time.

- **Map every processing activity.** Keep one living inventory of the personal data you hold: categories, purposes, lawful bases, retention periods and data flows. It produces the Article 30 records that GDPR and UK GDPR require, and holds the categories, purposes and retention periods that CCPA and CPRA notices describe.
- **Handle rights requests under each law.** A portal where people send access, deletion and correction requests. Each request runs on the deadline of the law that applies: 45 days under CCPA and CPRA, one month under GDPR and UK GDPR. On the hosted service it is included, with up to 100 requests a month through the public form (1,000 with the volume upgrade).
- **Keep every breach in one register.** Log, assess and escalate each incident with a structured workflow. For GDPR and UK GDPR, it runs the 72-hour clock and the Article 33 and 34 analysis for notifying the authority and the people affected. Incidents under US state breach laws are kept in the same register.
- **Structured impact assessments.** Guided DPIAs, PIAs, LIAs and TIAs for GDPR and UK GDPR, and the risk assessments that the CCPA regulations require in California. Risk scoring and mitigation recommendations are included.
- **Vendors.** The vendor register, with contracts and questionnaires; vendors can be imported from the VendorWatch catalog.

## Five stages, in order

Each step stays a draft until you review and confirm it.

1. Set up: the organization, where it operates and which laws apply to it.
2. Know your data: assets, processing activities and vendors.
3. Assess the risk: guided DPIA, LIA and TIA, one question at a time.
4. Rights and transparency: what you must disclose, and how to handle the requests people send.
5. Respond and improve: breaches, the audit trail and the executive report.

## Hosting

- TODO.LAW cloud: in the browser, on desktop or mobile. Nothing to install, and you can take your program elsewhere whenever you like with a simple export.
- Managed instance: an isolated instance we run for you, with a tailored SLA.
- Your own hardware: the TODO.LAW suite on a machine in your organization.

## Pricing

| Product | Price |
|---|---|
| DPO Central, AI Sentinel and VendorWatch on the TODO.LAW cloud | Start free (15-day trial), then $179 a month or $1,800 a year |

Visitors in the 27 EU member states see the price in euros: €179 a month or €1,800 a year. Managed instance or your own hardware: on quotation (https://www.todo.law/contact/managed).