Evidence-backed assessment, without giving up the legal judgment

Where this is today

• AvailableThe four kinds of fact, kept apart. Observed, declared, documentary and inferred are separate things in the model, and every section of every report says which of them its rows rest on.
• AvailableA record of processing built from the systems. Every object holding personal data, its fields, and the purpose, lawful basis and retention where somebody has recorded them.
• PreviewRecording a purpose, a lawful basis, a retention period or a recipient. The record and its history are built and reachable through the API. A screen for it is the next piece of work.
• AvailableUNKNOWN, and the missing evidence named. A field nobody has settled is reported as unsettled, never counted as clean.
• AvailableRisk from a combination of columns. A date of birth is moderate on its own and a postcode is low on its own; together in one table they identify most of the people in it. The risk register names the combination and the columns it rests on.
• AvailableSettle a field where it is drawn, with who changed it and when. Anything waiting on a person carries the control that settles it, on the row itself — in the field list and inside the schema diagram. Confirming agrees with the analysis and settles the field. Correcting it names the element it should have mapped to instead, records who did that and when, and leaves the field open: a correction nobody has checked is a better proposal, not an answer.
• AvailableThe reason somebody decided, kept with the decision. Immutably, a later decision supersedes an earlier one rather than erasing it, and it appears on the field’s evidence path.
• AvailableA legal category and a sensitivity level on every field, and the category cites its provisions. Personal data, an Article 9 special category, Article 10 conviction data, or not established — and, separately, EVIDENT’s own standard, elevated or high. The legal category cites the provisions it rests on, linked to the official text; both the category and the sensitivity level name the rules and versions that produced them. Open it on any column.
• PlannedCoverage per control across a framework — GDPR articles, ISO controls. A larger thing than the classification above, and a different one: adapters that read the evidence and report how much of a control it covers. Specified in advance; the evidence they would read exists today.

Available is in the product today. Preview is built and reachable, and still changing shape. Planned is specified and not built — published in advance so it can be judged before it exists.

What a schema can tell you, and what only you can

A database can be read for what exists. It cannot be read for why it exists, on what ground, for how long it may be kept, or who else receives it. Those are statements an organisation makes, and a tool that guessed at them would be inventing the half of an Article 30 record that carries the legal weight.

So EVIDENT reads one half and records the other. A purpose somebody enters is declared — true because the organisation says so. The same purpose citing a versioned retention policy is documentary — true because a document says so, and you can go and open it. The page never prints one as the other, because an auditor does not treat them the same and neither should a report.

The four kinds of fact

Observed

Read directly from a system. This column exists, it is of this type, and it may be null.

Declared

Asserted by the organisation. This table is for account management.

Documentary

Carried in a controlled document, with a version somebody can find again.

Inferred

Concluded from other evidence, with a confidence and the exact rule version that reached it.

What a column is, and who decided that

A data map is six thousand columns and one question about each of them. EVIDENT answers it in two parts, kept apart on purpose.

What the regulation calls it. Personal data, an Article 9 special category, Article 10 conviction data, or not established. Article 10 is its own answer rather than a worse Article 9, because they are different regimes: Article 9 prohibits processing subject to its own exceptions, and Article 10 permits it only under official authority or where a law provides safeguards. A tool that folded the two together would point you at the wrong legal regime for a background-check column.

How much attention it needs. Standard, elevated or high. That is EVIDENT’s own ordering, so a review starts with what matters, and it is not a scale the regulation defines — the product says so wherever it shows one. Risk is left to findings, where something is actually calculated: a telephone number is standard sensitivity and can sit inside a high risk.

Between the two sits a mapping rule with a version of its own, so the ordering can be argued with without changing what this product claims the regulation says.

What it will not tell you

That a name settled it

A column called "orientation" in a warehouse table is the direction a shelf faces. Unless the matched term can only mean one thing in a schema, or the table is plainly about people, the category stays not established, the candidate is recorded, and the row is marked as needing you.

That silence is a clean result

Absence of corroboration means unknown, never no. No field is pushed into a level to make a report look complete, and nothing becomes confirmed because nobody looked at it.

That the system decided

Every classification names the rule that proposed it, the rule-set version, the mapping version, and what the conclusion rests on — a term that can only mean one thing, the table around it, or the name alone. Until a person confirms it, it says proposed, not confirmed.

That an article applies because a score is high

The citation is tied to the classification, never to the level. A field at high sensitivity whose category is not established cites nothing as a basis — not Article 9, not Article 10, nothing — because a provision cited for a field nobody has classified would be asserting the classification through the citation. Where the category is established it carries every provision that bears on it directly: one, two or three of them, each linked to the official text in your language, with a line saying what the article is about. Anything a reader handling the field would also meet is listed apart, under its own heading, so it cannot be read as part of the basis.

Evidence coverage, and no number that stands for compliance

There is no percentage on any screen in this product that stands for how compliant you are. There is no such number, and printing one would be the single most damaging thing a tool like this could do: it invites somebody to manage the number rather than the risk, and it gives a reader a figure to quote that nothing behind it supports.

What is measured is how much of the assessment rests on evidence and how much does not. A field nobody has settled is UNKNOWN with the missing evidence named, not a gap quietly counted as clean. That distinction is the reason a report from this survives being read by somebody who came to disagree with it.

What you get to hand to somebody

• The record of processing activities, with each stated fact marked as declared or documented and each unstated one marked as not recorded.
• The findings, each naming the file, the table and the column it is about, and the rule version that produced it.
• What the analysis could not see, at full size and under its own heading, in every document it produces.
• The review history: who confirmed what, who rejected what, when and why. Nothing edited, everything superseded.
• Exports in HTML, Markdown, CSV or XLSX, each recording the analysis run and the build that produced it.