Data protection records you can show the Commissioner.
Agents that work alongside you, not instead of you.
Dembri Privacy Records reads your website, code and documents. Two agents propose findings with the evidence and the law. Your DPO reviews them. You decide.
An assessment tool. It does not act as your Data Protection Officer.
Website, code and documents flow to the Privacy Records agents. The agents cite DIFC, ADGM, UAE PDPL and Regulation 10 articles, and hand each finding to a named DPO for review.Sources in, cited findings out, your DPO reviews.
How it works
From a link to a report you can review.
Provide your website, upload your documents and, if you choose, authorise read access to your code.
Illustration of a scan. Not a real company.
Websiteacme-example.ae
Documentsprivacy-policy.pdf, 4 DPAs
Code (read only)github.com/acme-example/app
Reading 12 web pages
Reading 5 documents
Scanning 840 code files
Redacting personal data before any AI model sees it
Mapping processing activities
Checking vendors against contracts and policy
Drafting findings with the evidence and the law
9findings to review
7vendors checked
3AI systems mapped
Draft ready for your DPO to review.
Watch: the problem and the fix in about a minute
Narrated with an AI voice. Captions available.
When your product changes
Add a new tool. See what your records now need.
A new tool in your product is often a new vendor. Privacy Records checks each vendor three ways at each scan: is it in your code, is its DPA on file, and does your privacy policy name it.
Illustration. Not a real company.
Before
Tools in your product
SupabaseStripeResendAnthropic
Vendor
In code
DPA on file
In policy
Supabase
yes
yes
yes
Stripe
yes
yes
yes
Resend
yes
yes
yes
Anthropic
yes
yes
yes
These vendors appear in your code, your uploaded DPAs and your policy pages.
After you add a voice assistant
Tools in your product
SupabaseStripeResendAnthropic+ ElevenLabs
Vendor
In code
DPA on file
In policy
Supabase
yes
yes
yes
Stripe
yes
yes
yes
Resend
yes
yes
yes
Anthropic
yes
yes
yes
ElevenLabs
yes
no
no
ElevenLabs is in your code, but no DPA is on file and your privacy policy does not name it. ElevenLabs publishes its DPA as part of its terms: save a copy, record the date you accepted it, and name it in your policy.
What you get
Records your DPO can sign, built from evidence.
01
Findings with evidence and the law
Each finding shows where it came from: the page, document or code line, the date it was collected, and the article it rests on.
02
Vendors, contracts and policy
Each vendor in your code checked against the DPAs you hold and the vendors your privacy policy names.
03
AI systems and Regulation 10
One card per AI system with the DIFC Regulation 10 conditions: a gap only when a finding shows one, otherwise for your DPO to confirm.
04
Data map
Your processing activities, their recipients and AI systems on one map. Select an activity to see its purpose, lawful basis and findings.
05
A task list, not a PDF
Each finding becomes a task with an owner and a due date. Overdue work comes first.
06
Board summary
One page for leadership: what needs a decision, what is overdue, and what waits for your DPO to verify.
07
Notification draft
Draft answers for your DIFC data protection notification, with each transfer checked against the list of adequate jurisdictions.
08
Your DPO approves
A named reviewer accepts, rejects or edits each finding and records the residual risk decision. Nothing is final until they approve.
Vendors we recognise
The tools your team uses, recognised in code, contracts and policies.
The library currently contains 67 vendors: AI, cloud, payments, analytics, communication, CRM, identity and productivity tools, including UAE payment providers.
MapperData map: activities and AI systems listed2:30
DPO agentProposed: vendor outside the DIFC, no recorded safeguard. DIFC DP Law Art. 273:40
ASO agentProposed: notice does not mention the AI system. DIFC Reg. 10.2.2(a)4:25
DPO agentProposed: cookies set before consent. DIFC Reg. 9.25:00
ScoringLikelihood and impact set per proposal5:35
ReportDPIA, ROPA and AI register drafted6:40
DPO reviewPending. Your DPO reviews each finding.
Controller decisionYours. You accept, fix or dispute, and sign.
Illustrative example. Not a live scan.
How decisions work
The tool proposes. The DPO advises. You decide.
The log records who acted and when.
One finding, three roles
The tool
Transfers to a vendor outside the DIFC have no recorded safeguardProposed
Your DPO
Transfers to a vendor outside the DIFC have no recorded safeguardReviewed by DPO
You
Transfers to a vendor outside the DIFC have no recorded safeguardYour decision
01
The tool
Reads, screens and proposes. It makes no legal decision.
02
Your DPO
Reviews each finding and each fix, and advises in writing.
03
You, the owner
Fix gaps, prove fixes and sign the controller's decisions.
What you get
Available now.
DPIA
Description
Necessity
Risks
Measures
Records of processing
Activity
Purpose
Basis
Source
declared
declared
inferred
declared
AI systems register
System
Use
Human review
Drafts assemble from the scan. A person approves them.
Findings with citations
Findings link to stored evidence and legal text.
DPIA
A draft in the DIFC worksheet structure until approved.
Records of processing
From declared facts and evidence, with a source per row.
AI systems register
Regulation 10 register, or an inventory under other laws.
High risk processing assessment
Screening, your DPO's advice and your signed decision.
Fix claims with proof
What changed, the test and the result, for your DPO.
Audit log
Decisions include a name, time and version.
Monthly re-scan
Optional. It shows what changed.
Legal scope
The laws it reads, and the articles it cites
The law that applies depends on where you are licensed.
DIFC
Data Protection Law No. 5 of 2020 and the Regulations, including Regulation 10 on AI systems.
ADGM
Data Protection Regulations 2021.
UAE PDPL
Federal Decree Law No. 45 of 2021, for most other UAE companies.
A citation shows where a finding comes from. It is not a statement that you comply.
Regulators read what you can show
In 2025 the DIFC Commissioner of Data Protection listed 273 administrative fine decision notices for basic contraventions, such as non-renewal of notification.
In 2024 an ADGM start up with a DPO and an ISO 27001 framework received a USD 20,000 penalty. One access request was not answered within the legal deadline. It had no procedure for such requests.
Access is by invitation. Request a scan and we reply by email.
Does it replace a DPO? Who is the DPO?
No. It is an assessment tool. Your DPO is a named data protection professional who reviews the findings; where the law requires a DPO, you still appoint one.
Can my AI read it?
Yes, read only, through the MCP server, with a token you create and can revoke.
Get started
Request a scan
Tell us your company and website. Access is by invitation.
Dembri