Your cookie preferences
EDPB guidance · Art. 7 GDPR
We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.
You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.
You will find everything in our privacy notice.
The privacy & GDPR management software built by a DPO.
The software for DPOs and privacy consultants managing multiple clients: records of processing, data breach, DPIA, deadlines and documents for every client in one place. Each client gets a private link to send you privacy reports in real time.
Dott. Pietro Cravero
Built by a DPO, for DPOs.
I'm Pietro Cravero, certified Data Protection Officer and founder of Studio Cravero Consulting. DPO Workspace comes from my daily GDPR consulting work for public administrations and private organizations.
Every feature is designed to solve an operational problem I've encountered myself. No vaporware. No magical automation promises. Just tools you actually use every day.
When you handle 5+ clients, the system collapses.Scattered Drive folders, outdated spreadsheets, deadlines on Post-it notes. It works as long as you have one client.
Article 30 records in 5 different spreadsheets — Updated on different dates, you don't know which one is the latest.
Client A's deadlines in Client B's calendar — You miss a periodic review and only notice it afterwards.
Data breach: 20 minutes to find the documents — When a client calls, you waste precious time of the 72h window.
Regulatory updates pushed only to callers — You share them only with clients who call. Others fall behind.
Built by a DPO. For the real work of DPOs.
Not a generic tool retrofitted for privacy. A workspace designed around the real workflow of an external DPO: every client with their dossier, every deadline tracked, every breach with automatic audit log.
Same structure, every client
Not just an archive. A workspace that brings order, continuity, and traceability.
The client reports it. You already have the file open.
The hardest part of an external DPO's job is not the paperwork: it is finding out that something happened. Here the client tells you directly, with a link and a code, and the report is born as a tracked event.
You give them a link, not an account
Each client gets a private address with a code. No passwords to manage, no extra users to pay for.
The client describes what happened
A short form in plain language: what happened, when, who is involved. They do not need to know the GDPR to use it.
It reaches you before the phone rings
The report lands in the right client's queue, with a certain date and time. Who said what, and when, stays on the record.
It becomes an event with its own deadline
You pick the event type and the workflow starts: the steps to follow and the deadline computed from the law, not guessed. A data breach starts the 72 hours of Art. 33.
From a questionnaire to a document ready to deliver
Answer a few guided questions and get a professionally laid-out draft with your client's details. No more copy-pasting from old files.
Compiling and preview are free. Export included from the Pro plan.
Privacy document
Patient privacy notice
Provided under Art. 13 GDPR
Controller
Centro Medico Esempio
Generated
20/06/2026
Reference
DPOW-PAZ
Demonstrating compliance becomes tangible.
Everything you need to respond to a supervisory authority inspection or a client audit, without panic.
Upload and last modified date
Every document shows creation date, last modification, and author.
Document status
Draft, in review, complete, to update. Quick filters per client.
Per-client audit log
History of every operation (creation, modification, deletion) append-only.
Operational notes
Free annotations linked to the client to contextualize decisions.
Per-client deadlines
Configurable review frequency, alerts on upcoming or overdue deadlines.
Exportable client report
PDF package with client profile, Art. 30 register, and operational timeline.
Built on a real workflow.
Not a generic office software. A workspace built for those who work as DPO professionally, handle multiple mandates, and need to demonstrate accountability.
Independent DPOs
Certified professionals acting as external DPO for multiple entities or companies.
Privacy consultants
Consultants supporting clients on GDPR compliance without formally holding the role.
Law firms and privacy practices
Structured firms with multiple professionals managing privacy matters in parallel.
Public sector and healthcare experts
DPOs serving municipalities, schools, health authorities, with specific documentary needs.
SME and hospitality consultants
Specialists for SMEs, hospitality, retail with recurring mandates.
Consultant networks
Networks and cooperatives of privacy consultants sharing methods and tools.
EU hosting, encryption, audit.
DPO Workspace is built around privacy by design and by default.
Encrypted at rest and in transit
All files and metadata are encrypted at-rest on Google Cloud (AES-256) and in transit via TLS 1.3. No plain-text access along the chain.
EU hosting
Your data and documents are hosted on Google Firebase infrastructure, europe-west1 region (Belgium). No extra-EU transfer in ordinary operation.
Isolated client workspaces
Every user lives in a separate workspace. Database access rules prevent an account from reading another's data.
Action traceability
Every upload, modification, or deletion is recorded in an internal append-only audit trail - useful in case of inspection.
DPO Workspace is an operational tool that supports the DPO. It does not replace the professional judgment of the Data Protection Officer nor the responsibility of the data controller.
Read more about security and compliance →Everything a DPO manages, in one place.
31 pre-configured document areas. Upload documents, assign states, add notes. Everything in the right place, for every client.
Privacy notices
art. 13-14Collection, versioning, and review of notices under Art. 13-14 GDPR.
Appointments and authorizations
art. 29Letters of appointment and designations of subjects authorized to process.
Records of processing
art. 30Art. 30 register with editable form and sector templates.
Data processors
art. 28List of external processors and Art. 28 agreements.
DPIA and impact assessments
art. 35Risk assessment documents and DPIAs under Art. 35.
Data breach
art. 33-34Incident register with 72h notification timer under Art. 33.
Cookies and web
ePrivacyCookie policy, banner, and census of web processing activities.
Video surveillance
art. 88Signage, floor plans, assessments on the use of camera systems.
Privacy training
art. 39Certificates, materials, and tracking of training activities.
Data subject requests
art. 15-22Tracking of requests under Art. 15-22 GDPR.
Audit and deadlines
art. 24Audit documents, follow-ups, and document deadlines.
AI documentation
AI ActAutomated systems, AI Act, traceability of algorithmic decisions.
Extra-EU transfers
art. 44-49Register of transfers to third countries and TIA assessment (Chapter V, Art. 44-49).
NIS2 and network security
NIS2Documentation on security measures and NIS2 obligations beyond classic GDPR.
Ten things others would call a filing cabinet.
None of these is a promise: they are all in production now. Hover a card to hold it still.
Client portal
A private link per client: they report events without having an account.
Deadlines anchored to the law
You do not estimate the deadline: the article computes it. Art. 33's 72 hours start from the exact time.
Deadline .ics feed
Every client's deadlines in your own calendar, updating themselves.
OCR and full-text search
You search for a clause inside a three-year-old scanned PDF and you find it.
50 document templates
Notices, appointments, consents, AI Act: fill in a questionnaire, leave with a draft to review.
Annual Audit Pack PDF
A single file you can hand over: client sheet, Art. 30 register, timeline of operations.
Compliance score
For each client, what is missing and where. It tells you where to put your hours.
REST API and keys
Your data is yours outside here too: read access via API with revocable keys.
Team and roles
Invites, owner, editor and viewer permissions, and 2FA on every account.
Weekly digest
Monday morning you know what falls due, for which client, and what came in from the portals.
Simple pricing. Cancel anytime.
30-day free trial on every plan. No credit card required.
Solo
To get started
30 days free
- Up to 3 clients
- 1 user
- All 82 document areas
- Art. 30 register
- Data breach 72h
- Data subject requests (Art. 15-22)
- Staff training register
- Extra-EU transfers and TIA
- Audit log
- 5 GB storage
Pro
Most chosen plan
30 days free
- Unlimited clients
- 1 user
- Everything in Solo
- DPIA Wizard (WP248)
- OCR full-text search
- PDF client report
- Sector templates
- Monthly ZIP backup
- Public DPO profile
- Weekly digest
- 25 GB storage
Studio
For small firms
30 days free
- Unlimited clients
- Up to 5 users
- Everything in Pro
- Client relations map
- Annual PDF Audit Pack
- Read-only REST API
- Granular roles
- Priority support
- 100 GB storage
VAT included where applicable.
Latest rulings and updates
Analysis from a working DPO's perspective. Italian DPA, EDPB, fines and regulatory updates.
The invisible pixel in the newsletter: time runs out on 29 October
By decision no. 284 of 17 April 2026, published in the Official Gazette no. 98 of 29 April, the Italian data protection authority set out the rules for tracking pixels in email and allowed six months to comply: the deadline is 29 October 2026. Individual open-tracking for marketing purposes requires the recipient's consent, subject to exceptions. Compliance checks are part of the inspection plan for the second half of the year. For a DPO the point is not a prohibition — there is none — but that a processing operation taken for granted for twenty years now needs a basis, a notice and a way to switch it off on its own.
A dismissal decided by the algorithm is void: from 23 October in Italy
Published in Official Gazette no. 234 of 8 October 2026 and in force since 23 October, decree no. 179/2026 provides that final decisions on the employment relationship cannot be based solely on automated processing, that the worker may request an understandable explanation, and that decisions taken in breach are void. In parallel, AI systems affecting work organisation enter the risk assessment under Article 28 of decree 81/2008. For a DPO this is the rare case where the consequence is not economic but civil, and it changes how the check is framed.
Italian DPA fines Wind Tre €16.7 million: telemarketing despite objections and contracts activated without customers' knowledge
People who had objected kept receiving calls, and some contracts were activated without the person knowing. The Garante fines Wind Tre €16.7 million and restates a principle for every company with an agency network: responsibility is not outsourced along with sales.
Greece: €350,000 for a data breach — both the Ministry and the processor running outdated systems fined, and there was no Article 28 contract
An attack on the systems of the agency running a Ministry's programmes exposed identification, financial and health data of a very large number of people. The Hellenic DPA fines the controller €200,000 and the processor €150,000: notifying well is not enough if the supplier works on outdated systems and the relationship is not governed by a contract.
Smart glasses: the EDPB takes a position — users can be controllers, and people being filmed must be able to tell
They look like ordinary glasses, but they have a camera, a microphone and a connection. The EDPB publishes its first statement on smart glasses: when the user becomes a controller, why manufacturers and app providers cannot pass their obligations on to users, and what making a recording visible means in practice.
Guides and resources
Practical deep dives from the product and from DPO practice.
DPO software: internal and external
What you need when you handle more than one organisation, and the notification duty.
Records of processing (Art. 30)
What it must contain, who must keep it, Excel vs software.
Software for consultants and external DPOs
Multi-client by design: one workspace, all your clients.
AI Act: obligations and documents
The deadlines and the 7 documents to be ready for August 2026.
DPO software comparison
DPO Workspace vs 5 alternatives, no hedging.
Deadlines with a legal basis
Why every review interval cites its source.
Operational news for DPOs
Decisions and updates, turned into concrete actions.
How does the free trial work?
+
30 full days, no credit card required. After that you can activate a plan or let it expire — your data is kept for 90 days.
Does DPO Workspace replace the DPO?
+
No. DPO Workspace is an operational tool that supports the DPO in their activities. It does not replace professional judgment nor the responsibility of the data controller.
Is the data secure?
+
Yes. EU hosting (europe-west1), TLS 1.3 encryption in transit, AES-256 at rest. Daily backups. GDPR Art. 28 DPA available on request.
Can I export my data?
+
Yes, anytime. Client export to CSV/Excel, Article 30 record to PDF/Word.
Is it suitable for my small practice?
+
Yes, the tool is designed exactly for independent DPOs, small professional firms and privacy consultants managing 30-50 clients at a time.
What happens if I cancel?
+
Your plan stays active until the end of the period already paid. After that, access is blocked until you reactivate. Data is kept for 90 days post-cancellation.