Screen high-risk processing and build the DPIA record
Record the high-risk triggers, national-list evidence, necessity, proportionality, risks, measures and residual-risk decision for one proposed processing activity.
Tool available. Run the complete browser-local workflow and inspect the result. Paid export is not active. Entries and files stay in this browser. Sources reviewed 7 August 2026.
Built from fictional sample information using the same exporter as the tool.
UK DPIA review report sampleEU DPIA review report sampleWhat’s included
Set the assessment route
Keep the supported scope, file inventory and review sequence with the project.
- Start Here guide
Prepare the DPIA
Create an editable assessment and a formal report of screening, measures and residual risk.
- Editable DPIA working document
- DPIA screening and review report
Manage risks and evidence
Assign risk actions and retain the structured record, sources and assumptions.
- DPIA risks and actions workbook
- Structured DPIA record
- Sources and assumptions record
View every output and format
- Start Here guide
- Editable DPIA working document
- DPIA screening and review report
- DPIA risks and actions workbook
- Structured DPIA record
- Sources and assumptions record
Who this tool is for
Privacy, product, operations and project teams assessing proposed processing under UK or EU GDPR. Move from a documented screening decision into a reviewable DPIA without losing evidence, owners or the prior-consultation boundary.
Supported use
- One proposed or materially changed processing activity under the selected UK or EU route
- Supported Article 35 high-risk triggers, assessment subjects, risks, measures and review controls
- EU national Article 35(4) and 35(5) list evidence with a named competent supervisory authority
Have ready
- Organisation, assessment reference, responsible owner and complete processing description
- For EU routes, the relevant Member State, authority and current national-list evidence
- A reasoned answer and evidence note for every screening, assessment and decision subject
Needs separate review
- Whether the processing is lawful, necessary or proportionate in substance
- Member State, sector or authority criteria outside the recorded official material
- Prior consultation submissions, legal advice and approval by the competent decision-maker
How it works
- Describe the processingRecord the nature, scope, context, purpose, owner and proposed start position.
- Screen the high-risk triggersApply the supported Article 35 questions and, for EU routes, record the competent authority’s current lists.
- Assess risks and measuresRecord necessity, proportionality, consultation, risks, controls and expected residual risk.
- Approve or consultInspect the decision boundary, assign open work and retain the controlled DPIA record.
Where does this task apply?
Choose the guidance set this tool should use. The interface and outputs stay in English.
What this tool checks
The scope stays narrow so the result is clear and reproducible.
- Start Here guide
- Editable DPIA working document
- DPIA screening and review report
- DPIA risks and actions workbook
- Structured DPIA record
- Sources and assumptions record
From official material to a working record
Official material sets the basis
Official sources explain when a DPIA is required, its minimum assessment subjects and the prior-consultation duty.
The tool prepares the operational record
The pack makes the screening basis, national-list route, risk evidence, measures and final decision inspectable in one maintained record.
Official sources stay visible
Each supported check shows its jurisdiction, source title, source version and review date beside the result. Unsupported cases are rejected rather than estimated.
View this product's official sourcesQuestions before you use the tool
Scope, files, evidence and browser-local handling.
Does a completed pack approve the processing?
No. It organises the recorded evidence and identifies the supported route. An authorised person remains responsible for the assessment and decision.
How does the EU route handle national DPIA lists?
It requires the selected Member State, competent authority and evidence that current Article 35(4) and 35(5) lists were checked. A conflicting position fails closed.
What happens if high residual risk remains?
The result states that processing should not start before prior consultation with the ICO or competent EU supervisory authority, unless the risk is reduced.
Is project information uploaded?
No. Processing facts, evidence notes and generated documents remain in this browser.
Start the DPIA screening
Describe the processing, evidence each high-risk subject and review the prior-consultation boundary before approval.