No account needed. Answer a few questions, pay securely, and receive your deliverable right away.
Your company
The company named in the deliverable.
Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.
Deliverable
Its title, its author and its structure are yours: they steer what is written.
As it will appear on the deliverable.
Shown as the author of the deliverable; never filled in by the AI.
The processing
One processing activity, or a set of similar ones.
Who decides why and how the data is used.
Function, if one is designated.
From collection to deletion, who does what, with which system, and how many people are concerned.
One row per entry, e.g. “Provide and document medical care; Contract; Article 9(2)(h), care by staff bound by secrecy; Consultation notes, diagnoses; Period set by health rules; Care is the service the patient asks for”
Categories only, never the data itself.
Where, and on which basis. Say so if there are none.
Is a DPIA required?
Select what applies. These are the nine criteria of the WP 248 guidelines; national authorities publish further lists.
Necessity and proportionality
Why this processing, and why this much data.
Could the purpose be reached with less?
What is left out, and who sees what.
How they are told, and how they exercise their rights.
Risks to people
The harm to the people concerned, never the cost to the company. Rate each risk before and after its measures.
One row per entry, e.g. “A stolen password gives access to records; Phishing; Exposure of health data; Maximum; Possible; MFA, alert on bulk export; Maximum; Unlikely”
Advice and decision
Article 35(2) and 35(9).
Or why they were not sought.
The function that accepts the residual risks.
Anything the service should take into account.
What the AI provider receives
Your answers, to write this deliverable.
Replaced first, then put back in your deliverable: Email addresses, People's names, Company names.
