Art. 35 GDPR
The DPIA as a working tool, not a suffered formality
The impact assessment is the document separating DPOs who document decisions from those who fill in forms. In DPO Workspace the DPIA starts linked to the client's register and ends filed with its review deadline - for every client, in one place.
The guided path
- Describe the processing starting from the client's Art. 30 register
- Assess necessity, proportionality and risks with the guided matrix
- Define measures and residual risk, with legal sources alongside
- Export and file in the client record, with its review deadline
With risk analysis and the AI Act section alongside
The generator also includes the risk analysis (computed PxS matrix) and the Art. 27 FRIA: the DPIA talks to both. Free 30-day trial, no card.
Try it freeFrequently asked questions
When is a DPIA mandatory?
When processing is likely to present a high risk: systematic large-scale evaluation, large-scale special-category data, systematic monitoring of public areas (Art. 35(3)), plus the national blacklist cases: biometrics, worker geolocation, AI, vulnerable subjects, combined data sources.
What must a DPIA contain?
A systematic description of the processing and purposes; an assessment of necessity and proportionality; an assessment of risks to rights and freedoms; measures to address them (Art. 35(7)). If residual risk stays high, prior consultation of the authority (Art. 36).
How do DPIA and AI Act relate?
The AI Act FRIA (Art. 27) for high-risk deployers can build on an existing DPIA: same facts, complementary lenses (data protection vs fundamental rights). Connecting them avoids duplicate work.
Every client, its DPIA, its deadline
Register, risks, DPIA and documents: connected, not scattered.
Start free