DPIA software that drafts from the project's own documents and shows every risk move before you sign
Every new project assessed before launch, with each answer traced to its source.
See one case, screen by screen ↓DPIA software that drafts and scores privacy impact assessments and DPIAs for new projects and vendors. Seven agents screen each project, pre-answer the questionnaire from its own brief, diagram and contract with the passage behind every answer, challenge every data field and score each risk before and after its controls. The privacy officer accepts every control and the residual risk, and the DPO advises and decides any prior consultation.
How to choose AI solutions for back-office and enterprise work →
Updated
Before high-risk processing starts, GDPR Article 35 requires a data protection impact assessment: a systematic description of the processing, an assessment of necessity and proportionality, the risks to people and the measures that address them. California's risk-assessment regulations and the Colorado and Virginia laws now ask for the same kind of assessment. In most companies it is a 40 to 80 question form sent to a project owner who cannot answer it, forwarded to the architect and the vendor, and returned partial and without evidence. The privacy officer then rewrites the answers into a description of processing and scores risks in a spreadsheet, from memory or an old DPIA.
The answers were in the project's own brief, architecture diagram and vendor contract all along; nobody had time to read them side by side. So necessity is rarely challenged — "is each field needed?" is answered "yes" — controls are agreed in meetings but never evidenced, nobody records who accepted which residual risk, and the DPIA is filed and forgotten when the vendor adds a sub-processor or the design adds GPS. A DPIA that arrives after launch changes nothing and still costs weeks.
Estimated split for one full DPIA, from the demo company's 34-day median in 2025 to the 8 days of the sample case.
Seven agents screen, draft, challenge, score and re-check; the privacy officer signs and the DPO advises.
Kestrel & Vane Distribution wants a driver-facing fatigue camera from Ocellus Telematics in 1,860 trucks driven by 2,340 people in Germany, the Netherlands, Poland and Spain — pilot Mon 2 Nov, go-live Wed 2 Dec 2026. Here is DPIA-2026-118, screen by screen, in the working solution.
Sofia's home screen opens with a summary: the agents screened 3 new projects and re-checked 9 assessments since yesterday, and 6 things need her, led by DriveAlert. What the agents found sits in plain sentences with its sources: the risk agent and necessity agent propose dropping DriveAlert's face login, the control checker disputes a blurring control, and the screening agent flags palm-scan payments in the canteens.
“They answer from the assessments and documents, with sources, and act only when you say so.” — the Ask the agents panel
Tomas Herrera submits DriveAlert through the project portal at 08:30. The screening agent runs the threshold test: 5 of the 9 criteria — evaluation or scoring, systematic monitoring, sensitive data, vulnerable people (employees) and innovative technology — plus biometrics and tracking on the authority's list. Each criterion it ticks carries its source. Laws that apply: EU GDPR, and works council co-determination in Germany. Sofia confirms at 10:14 and DPIA-2026-118 opens.
The screening agent recommends; it never decides “no DPIA” on its own, and every override is recorded with a reason.
The intake agent reads the project brief v1.3, the architecture diagram v0.9 and the Ocellus master services agreement and DPA draft — 47 pages — and pre-answers 41 of the 48 questions in six sections, each with its source and a confidence score. What the documents do not say, it asks: 5 questions to Tomas, 2 to Kwame Asante in information security. It also writes the processing description: 8 operations, from recording the cab to recording the road ahead.
The intake agent never answers without a source; it leaves a question open rather than guess.
Q14 asks whether special category data is processed. The answer — yes, a face template stored to identify each driver — links to the contract, §4.2: the processor creates a facial template of each driver and stores it in its cloud for the term of the agreement. The passage shows who read it: the intake agent on Tue 6 Oct, and the control checker again on Wed 7 Oct. Tomas only confirms or corrects.
“Tell me what you need from me and I'll confirm it.” — Tomas Herrera
The risk agent found 8 risks: 3 high, 5 medium. On the 4 × 4 map each one is a ring where it starts and a dot where its controls take it, joined by an arrow; an unaccepted move stays dashed. Pick P2, “Log the driver in by face”, and only R1 stays lit: biometric identification, 3 × 4 = 12, high. In the conversation beside the map the risk agent proposes two controls from the company's own library, and the necessity agent asks why face login is needed at all: drivers already badge in at every shift.
“I propose two controls from our library: CL-07 edge-only processing with badge login, and CL-03 deletion of clips after 72 hours. Then R1 is 2 × 3 = 6, medium.” — Risk agent
Sofia asks in plain words before she decides. The risk agent answers with its sources: R1 stays at 3 × 4 = 12, high, even with 72-hour deletion, because the template itself is the risk. A privacy officer cannot accept a high residual risk, so Annelies de Groot would have to decide on prior consultation — and the authority can take 8 weeks, plus 6, past the pilot on 2 Nov.
Sofia accepts both controls with reason code A1, “Controls adequate and owned”. The dashed arrow turns solid: R1 moves to 2 × 3 = 6, medium. The control checker had already checked both controls against the contract on its own: edge-only mode exists, and clip retention can be set from 24 hours to 90 days. The risk agent reports the new picture — 0 high, 1 medium and 7 low — and says what is next: settle R5, then sign.
What remains of R1, in the risk agent's words: the camera still reads drivers' faces to infer fatigue, a health-adjacent state.
R5's control says faces and number plates in the road camera's clips are blurred before upload. The control checker, which never sees the risk agent's reasoning, read the contract itself: Annex 2 §2.4 says blurring happens only when a clip is downloaded or exported. It scores R5 at 2 × 1, not 1 × 1. Sofia keeps the checker's 2 × 1 until Ocellus confirms blurring before upload, and that confirmation becomes a condition of the sign-off.
The control checker can block sign-off; it cannot accept a risk.
The purpose is to reduce fatigue-related collisions by alerting drivers and dispatchers. Against it the necessity agent challenged 12 fields: drop 4 — the face template, continuous cab video, cab audio and the heart-rate wristband — limit 4 and keep 4, each with its reason and source. Accepting R1 decided two of them; 10 of 12 are decided, and the project owner may still contest GPS every second or the weekly score per driver with a reason.
Annelies recorded her Article 35(2) advice on Tue 13 Oct, and the consultation agent's plain-words summary went to Petra Lindholm, the works council chair. Sofia accepts the necessity agent's two remaining proposals — limit GPS to the event location, and the weekly score to trends — and with all five checks done she accepts the residual risk with reason code RA2, “Accepted with conditions”: Kwame's transfer impact assessment and penetration test, the works-council summary, Ocellus's written confirmation on blurring, and a review in 12 months or at once on any vendor or design change. She types her name to sign — eight days after the project arrived.
“Recorded with your name, the time and the evidence on the audit trail.”
The same DPIA, seen by four of the people who carry it — what an assessment looked like, and what it looks like now.
Seven agents screen, draft, challenge, score and re-check; the privacy officer signs and the DPO advises.
Runs the threshold test on every new project or vendor within minutes: the nine EDPB criteria, the authority's list and the US state triggers, with the reason for each criterion and the laws that apply.
Reads the project brief, the architecture diagram and the vendor contract together, pre-answers the questionnaire with the passage behind each answer, and writes the description of processing.
Challenges every data field against the stated purpose and proposes keep, limit or drop, with its reason and source.
Finds the risks in each processing operation, scores likelihood × severity with its reasons, and proposes controls from the company's own control library.
Re-checks each control against the evidence — contract clauses, the vendor's security report — and re-scores on its own, saying so when it disagrees.
Drafts the works-council summary in plain words, the DPO advice record and the prior-consultation pack, checked against Article 36(3)(a)–(f).
Watches vendor notices, new design documents, scope changes and review dates for every approved DPIA, and proposes reopening only the answers and risks a change touches.
Reason codes, e-signatures. The agents propose; a named person decides.
Ask about any risk, answer or data field — or tell the agents what to draft. Every answer points to the passage it came from, and nothing changes until you accept it.
Why is R1 high and not medium?
Two things push it up. Severity 4: a face template cannot be changed if it leaks, and it identifies the person. Likelihood 3: it is stored centrally for the whole contract, for 2,340 drivers. Our matrix calls 9 and above high.
What if we keep face login?
Then R1 stays at 3 × 4 = 12, high, even with 72-hour deletion: the template itself is the risk. A high residual risk cannot be accepted by a privacy officer; Annelies would have to decide on prior consultation, and the authority can take 8 weeks, plus 6, past the pilot on 2 Nov.
What is left before sign-off?
Your decision on R1, and which score stands for R5. Then sign. Annelies's advice is recorded. Three conditions will carry into the sign-off: Kwame's transfer impact assessment and penetration test, and the works-council summary before the pilot.
Draft the works council summary
Done: one page in plain words for Petra Lindholm — what the camera records, what it will never be used for, how long clips are kept, and how a driver contests an alert. It is on the sign-off page; nothing is sent until you say so.
13 screens from the working solution, on its sample data. Pick one to see it large.
What the agents may do, who decides and how risk is scored are settings. Changes are saved as a new version and take effect when the DPO approves them.
| Setting | Default | Choose from |
|---|---|---|
| High risk from | 9 on the 4 × 4 matrix | 8 · 9 · 12 |
| Residual high goes to | The DPO, for a prior-consultation decision | Existing DPIAs keep the matrix they were scored with |
| Privacy officer may accept residual risk | Up to medium | Roles: privacy officer · DPO · project owner · information security · works council · auditor |
| When a full DPIA is needed | Two or more of the nine criteria, or any item on the authority's list | Same processing as an approved DPIA: reuse it and record the reason |
| Templates | GDPR DPIA (48 questions), UK GDPR DPIA, California risk assessment, Colorado and Virginia data protection assessment | Also a light privacy review for vendor changes, and an AI impact assessment with the AI Act team |
| Control library | 14 controls, each with an owner and the evidence it needs | The risk agent proposes only from this library · add a control |
| Review | Every 12 months, and on any vendor, design or scope change | Vendor sub-processor notice: affected DPIAs reopened the same day |
| Service levels | Screening in 2 business days; owner questions and DPO advice in 5 | Reminders at 2 and 5 days · go-live within 14 days and unsigned: escalate to the DPO and the business head |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (GDPR Art. 83(4)(a) — up to €10 million or 2% of worldwide annual turnover, whichever is higher; GDPR Art. 36(2) — the authority advises within eight weeks, extendable by six; WP29/EDPB guidelines WP248 rev.01 — two of the nine criteria in most cases mean a DPIA). The 34-day median is the demo company's 2025 baseline. People, companies, projects and vendors named on this page are fictional — characters and sample data in the working solution.
DPIA software that drafts and scores privacy impact assessments and DPIAs for new projects and vendors. Seven agents screen each project, pre-answer the questionnaire from its own brief, diagram and contract with the passage behind every answer, challenge every data field and score each risk before and after its controls. The privacy officer accepts every control and the residual risk, and the DPO advises and decides any prior consultation.
The screening agent tests every new project and vendor against the nine EDPB criteria, the authority's list and the US state triggers, and cites the reason for each. Two or more criteria, or any item on the authority's list, means a full DPIA. The privacy officer confirms or overrides with a reason code, so a “no DPIA” decision is documented too.
It drafts what the documents answer and the owner confirms. On the sample DPIA the intake agent answered 41 of 48 questions from the brief, diagram and vendor contract, each with its passage, and asked the owner and information security the 7 the documents did not cover. It never answers without a source, and high-confidence answers can be confirmed in one step.
Yes. Templates cover the GDPR and UK GDPR DPIA, the California risk assessment and the Colorado and Virginia data protection assessment, and the screening agent names the laws that apply. In the sample, profiling US loyalty members triggers all three state assessments in one assessment.
A privacy officer cannot accept it; it goes to the DPO. The consultation agent drafts the prior-consultation pack and checks it against Article 36(3)(a)–(f), with the cover letter and the authority's clock of 8 weeks, plus 6. The DPO decides to consult the authority, send the project back for redesign, or stop it, with a reason code.
The change watcher follows vendor notices, design documents, scope and review dates for every approved DPIA. When a vendor adds a sub-processor, it names the answers and risks the change touches and proposes reopening only those. The privacy officer reopens them or dismisses the change with a reason.
Yes. The agents propose, explain and cite; they never sign, accept a risk, send anything outside the company or close a reopened DPIA. The project owner confirms answers, the privacy officer accepts each control and the residual risk with a reason code and e-signature, an independent checker can block sign-off, and no one signs a DPIA they prepared.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your questionnaire templates, control library, scoring matrix and the systems your projects live in — and it goes live once every quality gate has passed. Setup ends with a test on one of your approved DPIAs: the agents re-draft it from its documents and you compare the answers. Nothing goes live until the test passes and the DPO approves.
Every request answered inside its legal clock, with no other person's data released.
1-min demoEU AI Act ComplianceEvery high-risk AI system documented, cited and signed before 2 December 2027.
1-min demoData Processing Agreement ReviewEvery supplier DPA checked on all eight Article 28 terms, redlined from your playbook.
1-min demoWe'll run Privacy Impact Assessment on one of your own past DPIAs and the documents behind it.