Instead of DataGrail
Stop renting DataGrail. Own your privacy operations.
We build around your assessment process, retention reviews and request follow-ups. We bring your agreed DataGrail records across and run the system with your privacy officer.
DataGrail offers a complete privacy platform or individual products, with pricing by enquiry. Compare your actual agreement with the work your team needs.
- check_circleYour data in a database you own
- check_circleOpen source, no lock-in
- check_circleBuilt and run by Enterprise DNA
Read the agreement
What sits inside the DataGrail bill?
DataGrail sells more than a place to keep assessments. Separate the connected services you rely on from the record work you want to own. Its current website gives no numeric price.
A changing system inventory
Live Data Map discovers systems and helps maintain the privacy picture. Decide which discovery connections your business actually needs before changing that service.
The assessment process
Risk Assessments records contributors, progress, due dates, renewals and approval. Those are also the records your privacy officer needs for the next review.
Request fulfilment
Request Manager coordinates privacy requests across connected systems. A request register keeps your local follow-ups visible. Connected fulfilment is a separate requirement to scope.
Website consent
DataGrail offers consent management alongside its other products. Keep the consent service you need while agreeing which privacy operations move into your own system.
Processing activity reports
DataGrail supports processing activity records and exportable reports. Your own version can hold the purposes, recipients and review responsibilities your team uses.
Support and managed services
DataGrail offers support and optional managed privacy services. Compare those responsibilities with the installation and ongoing operation Enterprise DNA agrees to provide.
The work you can own
Make the next privacy review easier to finish
Assessment triage
Find the review that needs attention first
See each assessment beside its owner, recorded risk and open actions. A high score without evidence becomes work to complete, not a reassuring tick.
- check Rank assessments using your recorded likelihood and impact
- check See open actions beside the assessment they belong to
- check Find renewals coming up in the next sixty days
- check Ask for your own cross-record questions as the business changes
Retention review
Keep the reason for holding information visible
Record why a system holds information, who owns the decision and when its retention rules need another look.
- check Keep purposes and information categories with the system
- check List missing retention rules and review dates
- check Record the evidence behind security reviews
- check Compare processing purposes, recipients and ownership across systems
Request follow-up
Keep uncertain deadlines in the review queue
An unknown date stays visible. Your privacy officer records the confirmed deadline and its basis, then checks what still needs a response.
- check Track access, correction, deletion and other request references
- check Show overdue requests and dates approaching in the next fortnight
- check Keep the reason for each recorded deadline
- check Prepare an internal handling brief before a person responds
Review evidence
Know when an old approval needs another look
A review records the assessment version it considered. Changing the assessment, its system or an action makes that review stale.
- check Require evidence and closed actions before recording a review
- check Keep the operator and approving person with the decision
- check Read the history of changes behind the current position
- check Prepare branded assessment briefs and a weekly review
Make it yours
Design your own DataGrail replacement
Everything starts from the open-source base. Then it gets your name, the parts you run, your rules and your data from DataGrail. Try it here, and we build the real one.
2. What it runs
3. Make it fit
4. Your colour
Answered from your own database
Good morning. Here is what needs you today.
We build it from the open-source base, bring your DataGrail data across and run it for you.
What it looks like
Ask it like you would ask a colleague
Three real answers from fictional demonstration records. Ask about the next review, a missing deadline or the evidence behind a decision.
Privacy Operations for Claude Code
Connected to your own database
Which privacy assessments need attention first?
Marketing retention review
- Ner st
- Hana
- Atus ri
- in-review
- Sk_score op
- 16
- En_actions du
- 1
- E_date
- 2026-10-10
Client access assessment
- Ner st
- Mere
- Atus ri
- draft
- Sk_score op
- 8
- En_actions du
- 1
- E_date
- 2026-10-20
Support process assessment
- Ner st
- Tane
- Atus ri
- draft
- Sk_score op
- 4
- En_actions du
- 0
- E_date
- 2026-11-03
| Name ow | Ner st | Atus ri | Sk_score op | En_actions du | E_date |
|---|---|---|---|---|---|
| Marketing retention review | Hana | in-review | 16 | 1 | 2026-10-10 |
| Client access assessment | Mere | draft | 8 | 1 | 2026-10-20 |
| Support process assessment | Tane | draft | 4 | 0 | 2026-11-03 |
Ask it anything
Ten questions to ask of your privacy records
These answers come from the records in the free version. DataGrail also offers reporting. Add the questions your own review process needs.
Switching
How to switch from DataGrail
A move usually centers on exporting the assessment list, rehearsing its import, and deciding which other records and DataGrail services need separate handling.
- 1
Export the assessment list
Download the assessment list CSV from DataGrail’s Risk Assessments area. That is the documented import path, and it brings assessment records, not the full DataGrail platform. If you want to bring answers, attachments, request follow-ups, or other records too, check what your account allows with DataGrail and agree a separate migration scope before assuming they will move.
- 2
Rehearse the import
Ask the person setting up the database to rehearse the CSV import first. The rehearsal checks the rows without saving records. Have them map custom column headings explicitly and confirm the dates are understood correctly. Once the rehearsal is clean, load the assessment list into the new register. The import keeps original source fields, including fields without a matching standard field.
- 3
Review flagged records
Compare source identifiers and dates with the imported records, then review anything the register flags as missing, such as evidence, dates, or retention rules. Imported approvals remain historical, and each imported assessment starts in review. Have your team review it in the new register before treating the approval as current. Resolve mismatches and missing information before relying on these records.
- 4
Run both side by side
For a short period, use both systems while your team checks its assessment and review work in the new register. The new register covers administrative privacy records, not DataGrail’s discovery, consent enforcement, or connected request fulfilment. Keep those DataGrail services and connections active if you still need them. Compare identifiers, dates, owners, and review status, and resolve discrepancies before relying on the new register.
- 5
Switch off DataGrail
Once you have checked the records and agreed which services you still need, switch off only the DataGrail services you are replacing. Keep any services or connections your team still relies on. Before ending access, confirm that the assessment export and any separately scoped records you need are available, and that your team knows where to continue its review and follow-up work.
Where the real effort goes
The import itself is only part of the work. Most effort usually goes into matching your own column names, fields, and review rules, then deciding how much history to carry. The free import covers the assessment list, while answers, attachments, and other records need separate migration scope. If Enterprise DNA installs and runs it for you, they handle this mapping and migration work with you.
Not ready for a call?
Get your DataGrail switch plan by email
We will send you the step-by-step plan for moving your business off DataGrail, what the move really involves, and how we would do it for you.
Sent. Check your inbox.
Your DataGrail switch plan is on its way.
Rather talk it through? Book a call arrow_forwardThree ways to own it
Start with the free version, then choose the help you need
Open source
Do it yourself
Free, open source
- 1 Clone the repository, run npm install and npm run demo
- 2 Open the folder in Claude Code, Codex, OpenCode or Cursor
- 3 Rehearse import datagrail on your assessment CSV and confirm its header mapping
- 4 Start an empty database for your own records and use /weekly-review
Built around your business
We customise it
An agreed setup fee
- check Your assessment fields, review rules and evidence requirements
- check Your agreed DataGrail exports mapped and checked
- check A web front end for the people who need one
- check A different technology stack if that fits your business
Omni by Enterprise DNA
We run it for you
One setup fee, then a monthly retainer
- check Installed and operated through Omni by Enterprise DNA
- check Your approved connections and team access built to an agreed scope
- check Assessment briefs and review reports kept useful as your process changes
- check Your privacy officer keeps responsibility for legal decisions and responses
Questions
Instead of DataGrail, answered
Are we replacing the whole DataGrail platform? expand_more
The free starting point covers administrative privacy records: systems, processing activities, assessments, actions and request follow-ups. DataGrail also provides discovery, consent enforcement and connected request fulfilment. We agree which existing services stay and which connections or team screens Enterprise DNA builds into your version before you move.
What DataGrail history can we bring across? expand_more
The free import reads the assessment list downloaded from Risk Assessments. It keeps identifiers, names, assignees, dates and the original source fields. We check your export headings and date format first. Answers, attachments and other records need a separate migration scope. An imported approval stays historical until your team reviews the assessment here.
Does this decide our legal deadlines or prove compliance? expand_more
Your privacy officer confirms each deadline and records the basis. The system flags missing retention rules, evidence and dates. It does not certify compliance or send responses. Recorded reviews document a decision against a particular version, so you can see when the supporting records change.
Can our team have screens and controlled access? expand_more
Yes. Enterprise DNA can build the team screens, access controls, reports and approved connections around your responsibilities. The free version is intended for a trusted operator. We agree how sensitive information, backups and access are handled before a wider team uses your version.
How should we compare the price? expand_more
DataGrail offers its platform or individual products and asks buyers to enquire about pricing. Use your actual agreement and list the services you need to keep. Enterprise DNA quotes an agreed setup fee, then a retainer for ongoing operation. The open-source starting point is free to use and change.
Bring the agreement and one assessment
Spend 30 minutes with Sam. Show us what your privacy officer does each week, the DataGrail services you depend on and the records you want to own. We will outline the migration, custom work and ongoing operation your version needs.
Privacy Operations for Claude Code is free and open source, published by Enterprise DNA.
Done paying for DataGrail?
Get your version built