Skip to content
Contact support
  • There are no suggestions because the search field is empty.

Introduction to the Risk Module

The Risk Management module helps you assess threats to your organisation’s compliance and operations — whether it’s GDPR-related data risks or broader security risks under NIS2.

What is the .legal Risk Module?

The .legal Risk Module is a centralised risk management tool for identifying, assessing, and managing risks across your organisation. It gives your team a single place to document risks, assign ownership, and track remediation progress across processing activities, IT/OT assets, and compliance frameworks such as GDPR and NIS2.

The .legal Risk Module supports two types of risk assessment:

  • Risk assessments on processing activities (typically related to personal data)
  • Risk assessments on assets (typically IT/OT systems or infrastructure)

You can also assign each risk to a compliance domain — such as GDPR, NIS2, or an internal framework — to group and report on risks by regulatory obligation.

fullriskoverview

What is the .legal Risk Module used for?

The .legal Risk Module helps organisations systematically identify, prioritise, and respond to risks — whether related to data processing, IT/OT assets, or regulatory compliance obligations.

  • Identify and assess risks across the organisation
  • Prioritise which threats to act on
  • Document likelihood, impact and mitigating actions
  • Create tasks directly from risks by opening a risk record and using the Tasks section to assign follow-up actions to team members
  • Monitor changes over time using version history — each update to a risk assessment is recorded so you can track how risks evolve

Whether you’re preparing for an audit, tracking threats from vendors, or ensuring your systems meet your own InfoSec policies — the .legal Risk Module is your central hub for managing it all.

How does the .legal Risk Module handle GDPR vs. NIS2 compliance?

Each risk template lets you define whether it applies to GDPR, NIS2, or another compliance framework. This means you can tailor your risk assessments to the specific regulatory obligations most relevant to your organisation and report on them separately. For example, you can run a GDPR-focused risk review across all processing activities while simultaneously managing NIS2 obligations for your IT/OT assets — all within the same module.

Related articles