Choose the guidance set this tool should use. The interface and outputs stay in English.
Typical time
About 15 minutes
Price
$59
Outputs
3 included
Account
Not required to preview
Work on the real task
Nothing you enter or upload is sent to a server. Generate the working files in this browser, then review them before use.
Make every required assessment field visible before approval.
The final CPPA risk-assessment rules are effective from 1 January 2026. This tool records coverage and evidence; it does not make the required human decision.
35fields in scope
0present
0missing
35uncertain
0conflicting
Coverage and purpose5 fields
Worker SPI exception analysis
Explain whether the narrow worker-sensitive-information exception applies and why.
Specific purpose
A concrete purpose, not a broad label such as “business operations”.
Personal-information categories
List each category used in this activity.
Sensitive-information categories
List sensitive categories, or explain why none apply.
Minimum-necessary analysis
Connect the amount and type of information to the stated purpose.
Data operations13 fields
Collection methods
How the information enters the activity.
Use methods
How the information is used.
Disclosure methods
How information is made available to others.
Other processing methods
Storage, combination, inference or other operations.
Information sources
Direct, derived, purchased or other sources.
Retention by category
Period or criteria mapped to each relevant category.
Consumer interaction method
How the business interacts with affected consumers.
Interaction purpose
Why those interactions occur.
Approximate consumer count
Document the estimated number and basis.
Disclosures
What is disclosed and under what operation.
Delivery methods
How information or outputs reach recipients.
Recipient names or categories
Name recipients or provide meaningful categories.
Recipient purposes
Why each recipient receives or uses the information.
Benefits and negative impacts10 fields
Benefits to the business
Specific supported benefits, not an automated score.
Benefits to consumers
Identify affected consumers and concrete benefits.
Benefits to other stakeholders
Identify each stakeholder group.
Benefits to the public
Public benefit claimed and supporting evidence.
Negative-impact types
Cover access, availability, discrimination, loss of control, coercion, economic, physical, property, reputational, stigma and psychological harms as applicable.
Affected parties
Who may experience each negative impact.
Source and cause
Connect each negative impact to its source and causal pathway.
Likelihood and severity
Record separate reasoned estimates for each impact.
Safeguards linked to impacts
Describe each safeguard and identify the impact it addresses.
Residual risk
Record what remains after safeguards.
Decision and governance7 fields
Human benefits-versus-risks decision
Record the responsible person’s conclusion and reasoning; the tool must not decide this.
Decision whether to initiate or continue
Record the authorised decision.
Contributors
Include employees whose duties involve the processing and any consulted stakeholders.
Reviewer names and positions
Name the people who reviewed the assessment and their positions.
Approver names and positions
Name the approving people and their positions.
Decision-authority reviewer
Confirm a person with authority to participate in the initiation decision reviewed and approved it.
Review date
Record the formal review date.
Human approval remains required. “Present” without an evidence note exports as uncertain. This tool never calculates a benefits-versus-risks score.
The scope stays narrow so the result is clear and reproducible.
Structured assessment JSON
Field-by-field preflight PDF
Assessment timeline
How it works
PrepareAdd the information or file needed for this task.
CheckRun the bounded calculation, validation or completeness check.
ReviewSee what was found, what is missing and what could not be tested.
KeepPreview the useful result before choosing whether to retain an evidence record.
Official sources stay visible
Each supported check will show its jurisdiction, source title, source version and review date beside the result. Unsupported cases are rejected rather than estimated.
