Home / Tools

THE EVIDENCE TOOL SHELF

Inspect the method before you use the output.

Each page states what enters, what leaves, where processing occurs, which source/status it maps to, what it cannot determine and how to practise with synthetic data.

Open the toolbench Browse connected workflows

EIGHT PRODUCT RECORDS / BROWSER ONLY

Choose the evidence boundary before the instrument.

EVIDENCE INSTRUMENT In your browser

Rule 3 Notice Linter

Checks ten explainable cues across presentation, language, itemised data, purpose, withdrawal, rights, grievance, Board access, versioning and collection-surface context.

Input: Surface, expected data and purpose context plus pasted text or a local .txt, .md or .html file.
Output: Source-linked finding table, bounded text metrics, context coverage and a versioned JSON review report without copying the notice into the result.

HUMAN REVIEW BOUNDARY

It cannot decide whether a notice is legally sufficient, factually accurate, understandable to users, prominent or appropriate to the live collection journey.

Source/status: Final Rule 3 and Act section 13, read with corrected Rule 1 commencement wording: notified for 13 May 2027 commencement. Version and surface checks are local method evidence.

Open instrument 01 →View record

EVIDENCE INSTRUMENT In your browser

Consent Receipt Validator

Validates fourteen bounded fields across four evidence lanes, then classifies changed fields and comparison-order review cues.

Input: Earlier and candidate local JSON receipts, each capped at 250,000 bytes.
Output: Four-lane shape register, on-screen value diff and a data-minimised versioned comparison report.

HUMAN REVIEW BOUNDARY

It cannot prove a real event, establish valid consent, test withdrawal or processors, verify a digest, or claim the schema is government-mandated.

Source/status: Act sections 5, 6(1)–(8), 6(10): notified for 13 May 2027. Field shape, chronology and integrity prompts are explicitly local method evidence; no receipt schema is prescribed.

Open instrument 02 →View record

EVIDENCE INSTRUMENT In your browser

Data Inventory Mapper

Normalises twelve canonical fields into four completeness lanes, a paged table and an editable source-to-system-to-recipient relationship projection.

Input: Local CSV capped at 1 MB, 2,000 rows and 40 columns; four anchor headers are required.
Output: Editable local table and relationship map, full record JSON, data-minimised review JSON, spreadsheet-safe CSV and inert HTML report.

HUMAN REVIEW BOUNDARY

It cannot discover systems or data, validate evidence links, determine legal roles or purposes, test controls or prove that an inventory is complete.

Source/status: Transparent local implementation-evidence method; all legal and factual mapping remains context-dependent.

Open instrument 03 →View record

EVIDENCE INSTRUMENT In your browser

Retention Schedule Builder

Builds four inspectable decision lanes separating organisation policy, holds and other-law branches, final Rule 8 source review, and deletion coverage.

Input: Purpose, observable completion event, policy choice, hold review, source evidence, warning/log treatment, deletion coverage, owner and verification evidence.
Output: Completeness register, optional source-backed Third Schedule template and versioned local JSON record.

HUMAN REVIEW BOUNDARY

It cannot choose a lawful period for an organisation. Organisation-defined periods remain policy choices.

Source/status: Act section 8(7)–(8), section 12(3), final Rule 8 and its Third/Seventh Schedules: notified for 13 May 2027; applicability and other-law retention remain fact-specific.

Open instrument 04 →View record

EVIDENCE INSTRUMENT In your browser

Rights Request Kit Generator

Builds four operational lanes and an evidence-gated editable checklist for access, correction/completion/updating, erasure, grievance and nomination-related work.

Input: Non-identifying case reference, owner, received-time record, identity-risk choice, search and processor scope, decision/action records, response, escalation and controlled evidence references.
Output: Source-specific case frame, four lane summaries, 15-field completeness record and eight editable tasks with local evidence notes.

HUMAN REVIEW BOUNDARY

It cannot verify identity, discover records, decide exceptions, calculate a deadline, change a system or send a response.

Source/status: Act sections 11–15 and final Rule 14: notified for 13 May 2027 commencement; each workflow exposes its own source structure and limitations.

Open instrument 05 →View record

EVIDENCE INSTRUMENT In your browser

Processor Register

Builds four source-labelled review lanes and opens the first 50 bounded vendor or sub-processor records in an editable local table.

Input: Local CSV with the 12 mandated provider fields; optional record ID, relationship, parent provider, next review, owner and evidence-reference columns are normalised for re-import.
Output: Four-lane review summary, per-row open/date states, current review JSON and formula-safe CSV containing all records.

HUMAN REVIEW BOUNDARY

It cannot determine legal roles, read a contract, assess a provider, discover sub-processors, verify safeguards, contact an incident route or prove deletion, return or exit.

Source/status: Act sections 2(k), 8(1), 8(2), 8(5), 8(7)(b) and final Rule 6: notified for 13 May 2027; every role, contract and control conclusion remains fact-dependent.

Open instrument 06 →View record

EVIDENCE INSTRUMENT In your browser

SBOM & Data-Flow Triage

Traverses nested CycloneDX JSON iteratively, validates SPDX JSON records and parses bounded CycloneDX XML or SPDX tag-value before applying transparent category-name heuristics.

Input: Local CycloneDX JSON/XML or SPDX 2.x JSON/tag-value.
Output: Inspectable parser record and bounded questions for analytics, identity, storage, network, logging, messaging, payment, advertising or crypto review.

HUMAN REVIEW BOUNDARY

An SBOM cannot reveal actual personal-data processing, system behaviour or compliance. Every heuristic match needs manual confirmation.

Source/status: Privacy-engineering triage pattern, not a legal test.

Open instrument 07 →View record

EVIDENCE INSTRUMENT In your browser

Breach Detail Pack Planner

Builds three source-labelled evidence lanes for affected-person communication, the initial Board description and the 72-hour detailed Board record without transmitting incident data.

Input: Local incident facts, awareness anchor, mitigation, communication and evidence notes. Avoid unnecessary personal data.
Output: Inspectable completeness table, timing lanes and a memory-only structured record for deliberate export.

HUMAN REVIEW BOUNDARY

It cannot determine notification obligations, replace incident counsel or send a notification.

Source/status: Act section 8(6) and Rule 7: notified for 13 May 2027; other-law duties may still require separate review.

Open instrument 08 →View record