For the solo practitioner
Privacy team of one
If the entire privacy function is you — maybe you plus a fraction of Legal's attention — this page is the buying guide nobody writes, from someone who has run lean programs for fifteen years.
The trap for a team of one is buying a platform sized for a team of twelve, then spending your year feeding it instead of doing the work. The alternative isn't going without tools — it's sequencing them so each purchase closes the gap most likely to hurt you next. Here's that sequence.
The starter program, in order
Know what you process — RoPA Starter Pack ($39)
Everything downstream — notices, DSARs, vendor terms, breach scoping — depends on knowing what data you hold, why, and where it goes. Pre-structured Article 30 registers by department mean you're populating, not designing.
Why first: you cannot defend, disclose, or delete what you haven't mapped.
Start here →Say what you do — Policy & SOP Packet
Seven policies and six SOPs covering GDPR, UK GDPR, CCPA/CPRA, and HIPAA, editable in Word. Your register from step 1 tells you what these documents need to say; regulators and enterprise customers both start by asking for them.
Why second: written practice is the first thing every auditor, customer, and regulator requests.
Then this →Handle the requests — DSAR Command Center ($79) + Letter Pack
Requests are the obligation with a statutory stopwatch attached, and the one where a single miss invites a regulator into everything else. Tracked pipeline, running clocks, and nine ready-to-send letters for the full lifecycle.
Why third: it's the deadline you can't negotiate and the failure regulators fine most readily at small scale.
The pipeline →Control the vendors — Vendor Risk Scorecard ($59) + Multi-Jurisdiction DPA
Most of your risk walks in through other companies. A weighted scorecard makes diligence repeatable and defensible; the DPA template makes the paper match the promise across GDPR, UK, CCPA/CPRA, PIPL, and DPDP.
Why fourth: recent enforcement keeps landing on processor guarantees — "they seemed fine" is not diligence.
Score them →Catch changes early — PIA Builder ($99)
Plain-language screening questions a project owner can actually answer, turned into risk flags and DPIA triage. This is how a team of one finds out about the new tool before it launches instead of after.
Why fifth: once the foundation exists, intake is what keeps it true.
Build intake →Total for the five-step foundation: a few hundred dollars, each piece usable the day you download it, unlimited users, nothing to feed. Rebrand them, adapt them, make them yours — that's what the license is for.
When you're ready for more
Prove the program: run the Privacy Program Health Suite annually for the consultant-grade assessment and board-ready roadmap — without the consultant's invoice. Exercise the team: the Tabletop Kit turns your incident plan from a document into a reflex. Graduate the infrastructure: when spreadsheets start creaking, the self-hosted Privacy Portal ($499, unlimited users) replaces them — and PrivOptic Command is there the day "team of one" stops being true.
Not sure where you are on that arc? Every product has a live demo, and the free clock calculator costs nothing at all.