Data Protection Impact Assessment (GDPR Article 35)
The base: GDPR Article 35 for one processing activity, any sector, screening against the national trigger sources for the jurisdictions confirmed in scoping.
Workflow · DPIA
Your DPIA should know which country it is in.
Ansvar screens one processing activity against GDPR Article 35 and the national trigger evidence available across 29 European jurisdictional source paths.
Each surfaced trigger carries its official publisher, source status, citation, and verification context. The agent prepares the evidence record. Your DPO reviews applicability, necessity, proportionality, residual risk, and sign-off.
29 jurisdictions queried by name · 3 sources recorded unavailable · no model-memory citations
29jurisdictions whose own national source the run queries by name
Article 36a prior-consultation determination, with its basis recorded
Humancontroller and DPO judgment retained
A DPIA here is a staged interview, not a template you fill in. The run screens first: does Article 35 require an assessment at all, and on what basis — the Article 35(3) cases plus the supervisory authority's own mandatory list, fetched in the authority's own language for each jurisdiction confirmed in scoping. A source is cited, or the screen records it as unretrieved and marks the basis unresolved; it is never reproduced from model memory. Then the run takes the processing description, the DPO's position and your necessity-and-proportionality reasoning, enumerates the risks to data subjects for you to confirm, and scores each one on the CNIL severity and likelihood scale before crediting a single safeguard — and only safeguards you have actually built, since a planned control belongs in the recommendations rather than in the residual score. It closes on transfers, processors and an Article 36 determination: prior consultation, or not, with the reason recorded.
the family
One DPIA spine, a variant per supervisory context
Germany (BDSG-aware)
German practice, with competence split between the Land authority under § 40 BDSG and the BfDI.
Sweden (GDPR Art. 35 + IMY supervisory practice)
Swedish practice, reasoned against IMY as supervisory authority.
Drone / UAS Aerial Data Capture (GDPR Art. 35 + Reg (EU) 2019/947)
Aerial capture, where Article 35 meets Regulation (EU) 2019/947.
Having a source and querying it are separate states, and the coverage receipt publishes both. Today they coincide: all 29 operational jurisdictional source paths are named with their own native-language query in the deployed screening prompt. 3 further sources are identified but not reproduced — the run records them unavailable and never rebuilds them from model memory.
GDPR Article 35 is shared. National trigger material is not. The same processing activity can meet a published criterion in one jurisdiction, appear in indicative authority guidance in another, and require a statutory high-risk screen where no national-list mechanism exists.
national routing
National evidence routed from the jurisdictions you confirm.
The user or DPO names the jurisdictions to assess. Ansvar does not make an unqualified territorial-applicability decision.
The general high-risk threshold and the express Article 35(3) cases form the common baseline.
The screen retrieves the available list, guidance, draft, or statutory regime and records which source was checked.
A source is cited, classified as unavailable, or left unresolved. Generic guidance is not substituted without disclosure.
Read the public DPIA trigger-source receipt for the authority, source status, verification date, workflow state, and known limitation in each jurisdiction.
how a run works
Five stages the server enforces
- 1Screening & scope
whether Article 35 bites — the Article 35(3) cases plus the authority's own mandatory list, fetched per confirmed jurisdiction — then the processing description, the DPO's position, necessity and proportionality
- 2Risk identification
data-subject views recorded, risks enumerated, and the list confirmed by you before anything is scored
- 3Per-risk analysis
one step per risk: the rights affected, CNIL severity and likelihood, then the safeguards that reduce it
- 4Consultation & compliance
transfers, processors, and the Article 36 determination on prior consultation
- 5Report
the assessment and its risk register — structured for your agent, rendered for your auditor
ask your agent
Paste one of these to start
Using Ansvar, run a GDPR Article 35 DPIA for our new HR analytics platform. Confirm the relevant jurisdictions with me, screen the applicable national trigger sources, then continue to the prior-consultation determination.
Using Ansvar, show the DPIA trigger-source coverage for Germany, Estonia, Cyprus, Switzerland, and the United Kingdom. Preserve each source's status and do not decide territorial applicability for me.
install the skill
A prompt starts one run. The skill is the same guidance installed once — the run loop, the evidence and citation rules, and the starters — so your agent works this way in every conversation, not only the ones you remember to paste into. Install it as a skill in Claude or Claude Code, or paste the same file into Microsoft Copilot or a custom GPT's instructions.
Impact Assessments — DPIA and FRIA · version 1.0.4 · SKILL.md · ZIP · how to install it
Free gets one workflow run a month and Solo two, spendable on the base DPIA against a processing activity you describe, and a Free or Solo run can also return a render carrying a self-asserted banner. Premium adds the German, Swedish and drone variants on five runs a month. Team and Company run them against records you upload and add unwatermarked HTML, PDF and DOCX exports. Run allowances and what each tier adds live on the pricing page.
jurisdiction receipt
The screen produces a reviewable source record.
Every jurisdiction checked keeps the facts used, the criterion tested, the source status, and the reviewer decision. That turns national-list coverage into a record another person can inspect.
- Jurisdiction
- Estonia
- Supervisory authority
- Andmekaitse Inspektsioon
- Source type
- National DPIA trigger material
- Legal status
- indicative authority material
- Source version
- Publication or retrieved version
- Matched criterion
- Exact criterion identifier, or none
- Supporting facts
- Supplied facts or customer-document evidence
- Citation
- aki.ee
- Verification date
- 2026-08-15
- Result
- Match, no match, or unresolved
- Reviewer decision
- Pending, accepted, or overridden with rationale
human boundary
The machine assembles the file. A human owns the judgment.
Ansvar can identify relevant source material, test documented processing facts against recorded criteria, assemble the risk register, and validate citations.
It does not decide whether the processing is necessary or proportionate, accept residual risk for the controller, replace the DPO, or issue a compliance approval.
Questions buyers ask first
- Which plan do I need to run one?
- Any of them, for part of the family. Free gets one workflow run a month and Solo two, spendable on the base DPIA against a processing activity you describe. The German, Swedish and drone variants start at Premium. Team and Company add runs grounded in records you upload. The pricing page carries the allowances.
- Which national lists does a run actually query today?
- All 29 operational jurisdictions across the EU, the EEA, Switzerland and the United Kingdom — each named in the deployed screening prompt with a query in the authority's own language, because an English meta-query misses lists published in Greek, Lithuanian or Icelandic. Luxembourg, Malta and Slovakia are identified but not reproduced. The coverage receipt records the state of every jurisdiction against the deployed workflow bundle, so any gap is published rather than implied.
- Will our supervisory authority accept this as our DPIA?
- The document is yours, not ours. A run produces the Article 35 record — processing description, necessity and proportionality, the scored risk register, the safeguards and the Article 36 determination — with each conclusion cited to the provision it rests on. A controller still signs it and a DPO still reviews it. Ansvar issues no approval and makes no finding of compliance.
- Do we have to upload our records?
- No. On Free, Solo and Premium the run interviews you and assesses what you describe. Uploading your own records is what Team adds: the assessment then anchors to the exact paragraph it came from, with a content hash, so a reviewer can check a conclusion against your document.
- What happens when a supervisory authority's own list is not in a corpus you serve?
- The screening records the gap and marks the basis unresolved. Several authorities publish an Article 35(4) list of processing that always requires a DPIA; where we do not serve that list, the run says so rather than reproducing it from memory. A negative screening outcome is never grounded on a list that was not actually retrieved. A DPIA you hand to a regulator has to be honest about what it could not ground.
- Does it decide whether we need prior consultation?
- It makes the Article 36 determination and records what the determination rests on: the residual risk after safeguards, measured against your own thresholds. Whether you then contact the authority stays your call.
as a service
Prefer we run it?
Every workflow here is also an expert-run service: we run it against your systems, review the output as practitioners, and hand over the finished deliverable. See the services page for how engagements work, or contact us to scope one.
Related: Free DPIA template · DPIA trigger coverage · Worked DPIA run · STRIDE threat model · Privacy sector · Drone & UAS sector · Vendor DPA directory · Workflow docs · Have us run it
Run it against your own systems
Connect the AI client you already use and ask your first cited question — Free, Solo, Premium and Team are self-serve.