Processing and processors
Keep processing activities, purposes, data categories, lawful bases, retention and transfer details alongside your processor records.
Your team supplies business context and confirms the legal grounds recorded.
Platform
Compliance that asks less of you.
Estreat reuses your company records, prepares supported report content and screens processing changes. Review the sources, supply missing context and make the decisions that need your judgment.
Our automation target
At most 10% manual input.
Every fact that can be collected or reused should be. People provide missing business context, resolve exceptions and make the decisions they are responsible for.
This is our product target. We have not yet measured a 90% reduction in input across completed customer workflows.
See the path to that targetIn the platformRecords · evidence · review · retained outcomes
The foundation for your daily work.
Start with the Nigerian data protection workflows below. Each brings the record and the work around it into the same company workspace, with automatic preparation where supported sources exist and human review of the conclusions.
Impact assessments
Screen recorded processing facts when an activity is created or changed, and prepare a linked DPIA draft where those facts indicate one.
Your DPO resolves unknown circumstances and assesses necessity, risks and mitigations. Material source changes reopen review; screening does not approve the processing.
Rights requests
Track request types, receipt dates, due dates and outcomes in one company register.
Your team verifies authority, carries out the request in the relevant systems and records the outcome.
Breach response
Record awareness, risk decisions, response work and notification records, with review history and retained delivery receipts.
Authorised people decide who must be notified, send the notification and retain evidence of delivery.
Evidence and training
Extract literal observations from supported documents and exports, retain their source locations, and organise training evidence. Azure and Microsoft Entra ID connections support collection of technical evidence.
Extraction reports its scope and omissions. Review observations before reuse; accepting a value does not establish its legal validity.
DPO reporting
Start an Article 13 report with factual sections prepared from existing company records. Refresh draft sources, retain submitted versions and record receipt by the designated officer.
The DPO reviews the sources, supplies missing context and makes the assessment. Refresh preserves authored text and reopens affected assessments when its source facts change.
CARPath
Use the Schedule 2 source questionnaire and prepare supported answers from company records, reviewed profile details and retained reports or training evidence. After review, record an explicit reviewer declaration and retain that return as JSON, Markdown or PDF.
You can record an external-submission statement with the submission date and an optional reference. Estreat does not submit the return, verify regulator acceptance or certify compliance. The usual filing route is through a licensed DPCO, except as otherwise approved by the Commission under GAID article 10(14).
Company and provider workspaces
Work with company roles and audit history. Providers can arrange client billing coverage with separate acceptance by each client administrator.
A client controls access to its records. Buying provider capacity does not grant membership of a client company.
Automation deliveryCollect once · reuse · resolve exceptions
Make the record do the work.
Available preparation and source reuse reduce repeated copying. The next stage connects more sources and routine actions, with the remaining questions brought to you in context.
- Available
Prepare reports from company records
DPO reports begin with supported factual sections. CAR preparation reuses company registers and retained reporting and training evidence. Refresh sources before review; your authored text is preserved and changed facts need a new review.
- Available with review
Extract supported document content
Read literal content from text PDFs, DOCX, XLSX, CSV, JSON and labelled text. Recognise printed English in PNG/JPEG images and PDF pages without a text layer. Keep source locations and review the observations against the original. Extraction is partial. Handwriting and other languages are outside the OCR scope; signatures, layout and spreadsheet calculations are not interpreted. Image text on PDF pages that already have a text layer is not read.
- Available with confirmation
Reuse reviewed company details
Select reviewed observations for shared company identity and contact fields, compare the existing values and confirm the changes. CAR preparation reuses that profile with its retained sources and corrections. A contact name or registration reference does not establish an appointment or legal status.
- Available
Screen processing changes
Saving a processing activity screens its recorded facts and prepares a linked DPIA draft where indicated. Material source changes preserve authored assessment text and prior versions, then reopen review. Existing records can be screened in batches; your DPO makes the assessment and processing decision.
- Planned expansion
Connect more sources and actions
Additional business-system connections, broader reassessment and routine action execution remain in development or planned. Current document extraction and processing-record screening do not yet provide continuous maintenance across every workflow.
- Partial measurement
Measure the work removed
CAR input counts distinguish reuse, manual supply or corrections, missing inputs and review. Measurement across complete workflows, including initial setup, repeated facts and review time, is still incomplete. Those counts do not establish a 90% input reduction.
The target counts each required input once. A missing input remains missing; copying one fact into several reports does not multiply the saving. Review and approval effort must be measured alongside input, so a generated document alone cannot establish the target.
Country coverage
Built in Nigeria. Working toward Africa.
The current legal baseline is Nigeria’s NDPA 2023 and GAID 2025. Our ambition is to connect governance and compliance work across Africa while respecting each country’s law, regulator and filing process.
Discuss your country or group requirementsNigeria: current baseline
Nigerian privacy records, evidence, reporting and audit preparation. The usual CAR filing route is through a licensed DPCO, except as otherwise approved by the Commission under GAID article 10(14).
Additional countries: planned
Country coverage will require local legal review, obligation mapping and tested workflows. South African POPIA and Kenyan data protection coverage are not available country packs today.
Start with the work you repeat most.
Bring one process and the sources you already use. We will walk through the current workflow, the input it still needs and the automation you want next.