Risk Landscape

Where compliance gaps get identified, tracked as risks, remediated, and reported on. Your consultant drives the day-to-day work here; your main role is tracking progress and signing off when a risk is genuinely resolved.

Gap Analysis

AI-detected compliance gaps, found by cross-referencing Discovery data (RoPA, vendors) against the Global Framework controls and applicable laws. Gaps are surfaced automatically, then triaged and worked by your consultant.

Top stats: Total, Open, In Progress, Closed, Critical Severity — a quick read on how many open issues your program has and how urgent they are.

Opening a gap shows an Edit Gap panel, split between what your consultant can edit and what's fixed:

• Editable (workflow fields): Title, Description, Gap Type, Status (Open / Accepted / In Progress / Closed), Owner, Due Date, Residual Risk
• Read-only (the AI's finding): Department, Source, Source Detail, Severity, and the specific Applicable Law/Article the gap violates

If you see a gap marked Accepted rather than Closed, that means the risk was consciously accepted rather than remediated — worth knowing which gaps in your program fall into that bucket.

Risk Register

Risks are usually escalated from Gap Analysis by your consultant, then tracked here through to closure. Top stats: Total, Critical, High, In Remediation, Closed.

Opening a risk shows three tabs:

Overview — the risk detail: Description, Category, Department, Severity, Likelihood, Impact, an overall Risk Score (e.g. 18/25), and Penalty Likelihood (tied to a specific law, e.g. "High — GDPR Art. 28"). It also links back to the source gap(s) and mapped controls, and includes AI-generated mitigation suggestions your consultant works from.

Remediation Plan — a checklist of action items, each with an owner, a due date, and a status (Done / Overdue / Due <date>), assigned and tracked by your consultant. Owners are notified automatically on assignment, with reminders at 14 and 3 days before the due date and on the day itself; anything overdue by 7+ days escalates to the DPO. If you're listed as the owner on an action item, that's a signal it needs something only you can provide (e.g. a decision or a document).

Closure — locked until every remediation action is marked Completed.

What you can do here

Once unlocked, closing the risk requires DPO or Program Owner approval — this sign-off has to come from your side, since it's confirming the risk is genuinely resolved for your organization, not just that the checklist is done.

Reports

Five report types, each exportable — useful when you need to hand something to an auditor, regulator, or your own leadership without walking them through the live app.

Controls Compliance — a flat, searchable, CSV-exportable table of every framework control and its status.

Website Privacy Audits — an AI-powered scanner that crawls a website and evaluates it against 20 compliance domains (Consent Management, Cookies, Data Subject Rights, Cross-Border Transfers, and so on) across India/EU/US jurisdictions. Your consultant typically runs these; results include screenshots as evidence, a plain-language "why it matters" explanation per finding, and the specific statute/section it maps to (e.g. a DPDPA or CCPA citation) — downloadable as PDF or plain text.

Business Processes — a read-only, report-friendly rollup of RoPA records grouped by department, for when you need to hand someone a summary rather than the live working view in Discovery.

Vendors — every vendor with its computed risk level and status, plus a per-vendor PDF report you can download.

Minutes of Meeting — pick a department and click Generate MoM to have Dutro draft a minutes-of-meeting document summarizing that department's privacy program status.