Ansvar AI docs
    ansvar.eu →

    DPIA

    A guided Data Protection Impact Assessment under GDPR Article 35. The workflow walks you through screening, processing description, DPO consultation, risk identification, per-risk analysis, consultation steps and the final report — with citations to the articles and authority guidance that apply. The product overview, including the German/Swedish and drone variants, is on the DPIA family page.

    Tier

    Every plan can run it against a processing activity you describe — the DPIA is one of the seven included workflow types. Free starts 1 workflow run a month and Solo 2, reported as a watermarked rendered document or structured JSON. Premium runs the full interview-grounded catalog (5 runs a month) and receives the complete report as structured JSON; unwatermarked HTML, PDF and DOCX renders start at Team. Team and Company additionally ground the DPIA in your own uploaded documents — processing records, DPAs, policies — via the document plane. Company tier additionally produces a cryptographically anchored audit package via export_audit_package for regulated verticals that need offline-verifiable evidence.

    What you ask the agent

    Using Ansvar: start a DPIA for our new HR-screening feature.
It scores candidates from CV text and an applicant questionnaire,
processing data of EU candidates, hosted in Sweden.

    The agent calls start_workflow(workflow_type="dpia") and works the stages in turn. Document evidence (data flow diagrams, sub-processor lists, retention schedules) is registered through register_document and cited at paragraph level.

    Confirm the jurisdictions and screening sources

    Confirm the jurisdictions with your DPO or responsible reviewer before screening. The workflow retrieves the national trigger material available for that scope and keeps its status: a published list, indicative guidance, a draft and a statutory test are not interchangeable. The DPIA coverage register names the source, status and known limitations by jurisdiction.

    If a required source cannot be fetched, the assessment records an unresolved basis. An empty search does not establish that no DPIA is required. Review the unavailable evidence and the reasons for the screening outcome before proceeding to the prior-consultation determination. Ask scope_workflow or list_workflow_types for the suitable variant; do not infer a variant id from a country code.

    Stages

    1. Screening & scope — screening question to confirm a DPIA is required, structured processing description, DPO consultation note, document collection, necessity and proportionality assessment, user-reviewed scope confirmation.
    2. Risk identification — data-subject views (where applicable under Article 35(9)), risk enumeration, user-reviewed risk list. Risk enumeration follows the EDPB WP248 criteria and CNIL/ISO 29134 methodology, grounded with GDPR-framework search results for the workflow's jurisdictions.
    3. Per-risk analysis — this stage is dynamic: one analysis pass per risk identified. Each risk is scored on the CNIL/ISO 29134 severity × likelihood grid (inherent and residual), with mitigations attached per risk.
    4. Consultation & compliance — international transfer compliance check, supervisory-authority consultation note where the residual risk requires it (Article 36).
    5. Report — generate_report(workflow_id) assembles the DPIA document with all evidence references and citations.

    What you get back

    A DPIA report with: processing description, lawful basis and purpose, data-subject categories, necessity and proportionality assessment, risk register with per-risk scoring and mitigations, consultation outcomes, and the residual-risk decision. Each substantive claim cites either a GDPR article, an EDPB guideline, or a national-authority opinion.

    Review the diagram and delivery receipt

    The workflow can include an optional system data-flow diagram. Review the people, systems, data stores, transfers and trust boundaries against your processing description. Accept the diagram or follow the step's explicit skip path; the assessment must not fill missing system details from guesses.

    Alongside the report, generate_report returns a delivery_receipt. Ask your agent to display delivery_receipt.display_markdown unchanged so the integrity state and unresolved screening or consultation evidence stay visible. Receive the full report as well; a chat summary is not the deliverable. See report delivery for artifact formats and hashes.