- Home
- Suite features
- DPIA tool
The DPIA cockpit: from trigger check to prior consultation
The DPIA tool in the Regingada Compliance Suite structures the screening for a data protection impact assessment (DPIA) under Article 35 GDPR: five trigger markers, twelve factors from the nine criteria endorsed by the European Data Protection Board (EDPB) and Art. 35(3), and an Article 36 consultation tracker. Whether a DPIA is required remains a legal judgement.
- GDPR · Art. 35(1), (3), (7)
- DPIA text · not drafted
- Authorities outside Germany · not listed
When is a DPIA required — and who decides?
Article 35(1) GDPR requires a DPIA before processing likely to result in a high risk to people's rights and freedoms. Art. 35(3) names three cases, each supervisory authority lists more under Art. 35(4), and the nine WP248 criteria, endorsed by the EDPB, guide the test for everything else. The controller decides and must be able to show why (Art. 5(2) GDPR).
Article 35 asks neither where the controller sits nor how large it is: a US company caught by Art. 3(2) GDPR screens as a Munich company would. A missing Article 35 GDPR DPIA falls under Art. 83(4)(a): up to EUR 10 million or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. Nor is a DPIA a generic privacy impact assessment (PIA): Article 35 fixes its triggers and contents.
Templates and DPIA software help once an assessment is due. The costly gap opens earlier: WP248 rev.01 expects a controller who meets two criteria but skips the DPIA to document why. A DPIA screening with one reason per criterion can serve as that record.
From the first click to a documented screening
Open /suite/#gdpr. Then:
- Confirm the legal notice (first visit only). If the welcome screen appears, choose the GDPR card ('Open GDPR twin →').
- Answer the five quick-check questions. Closing it early returns you to Home. 'Yes' or 'Unsure' on special categories (Art. 9 GDPR) or automated decisions (Art. 22 GDPR) opens the DPIA cockpit; so do the 'Processing Inventory' chips 'Thousands of data subjects', 'Video surveillance (DSK list)' and 'Credit scoring (KI-Score)'.
- Click 'DPIA Cockpit' in the 'GDPR · L4' sidebar. Trigger Status shows which of five markers you hit; beside it, seven Art. 35(7) steps. Sub-sections have no direct link: use the sidebar or the four arrow buttons.
- Work through 'DPIA Risk-Assessment'. Set each of the twelve factors to Applicable, Not applicable or 'Unclear / to be reviewed', write the reason, export the matrix.
- Only if high risk remains: 'DPIA Prior-Consultation'. Tick the triggers — residual high risk under Art. 36(1) is the general one — pick the authority, enter the date. 'DPIA Records' and 'DPIA AVV' (the Art. 28 processor agreement) appear with the cockpit, although Art. 30 and Art. 28 apply without any DPIA; detail under GDPR compliance software.
What the DPIA tool shows, and on which legal basis
As DPIA software, the cockpit covers screening, the Art. 35(7) contents and the Art. 36 timeline; the assessment text stays yours.
| Capability | Legal basis | Output |
|---|---|---|
| Trigger Status | Art. 9, 22, 35(3), (4) GDPR; EU Court of Justice, C-634/21 | Five markers, filled or empty |
| DPIA minimum content | Art. 35(2), (4), (7)(a)-(d); Art. 36 | Seven-step list, read-only |
| DPIA Risk-Assessment | Art. 35(1), (3)(a)-(c); WP248 rev.01 | Twelve factors with status and reason, live count, JSON file |
| DPIA Prior-Consultation | Art. 36(1)-(3); Art. 36(5) where national law applies; Art. 56 (which authority, not whether) | Trigger matrix, authority picker, deadline, status |
| DPIA Records · DPIA AVV | Art. 30(1); Art. 28(2)-(4); Commission Implementing Decision (EU) 2021/914 | JSON annex editors; the Art. 30(1)(a) field names the activity, not the controller |
Twelve factors, one reason each
Every factor starts as Unclear; the count rises only with Applicable and is a screening signal, not a verdict.
Prior consultation (Article 36), dated
The tracker adds the eight weeks of Art. 36(2) to your submission date, fourteen with the extension. The statutory period runs from the authority's receipt and can be suspended (Art. 36(2)).
Entries stay in your browser's localStorage; there is no account. Data handling: Trust Center.
A credit-scoring provider, screened
BonitätsCheck FinTech GmbH is a fictional demo profile: a Frankfurt company selling credit scores to banks (BonitätsCheck model case). Enter its quick-check answers yourself (automated decisions 'Yes', special categories 'Unsure'): two of five markers fill; an entry you add with the chips 'Credit scoring (KI-Score)' and 'Thousands of data subjects' fills two more.
The team marks six factors Applicable (scoring, automated decision, large scale, matching datasets, refusal of a contract, Art. 35(3)(a)) and leaves sensitive data Unclear: payment histories may be highly personal data under WP248, and postcodes may act as Art. 9 proxies. The count reads 6/12.
The count is the least telling part: Art. 35(3)(a) alone makes the DPIA mandatory. Why C-634/21 (7 December 2023) can bring the score itself under Art. 22(1) GDPR is set out in the model case. Resolve the Unclear factor first; a seventh Applicable changes the label, not the Art. 36 question.
Had high risk survived the DPIA, the team would pick HBDI, the Hesse authority; a submission date of 1 October 2026 gives a deadline of 2026-11-26, or 2027-01-07 with the extension.
In a US company with no EU establishment, two things change: there is no lead authority under Art. 56 GDPR, and the Art. 27(2)(a) exemption from appointing a representative (occasional processing, no large-scale Art. 9 or 10 data and unlikely to result in a risk, all three) is hard to square with a high-risk screening.
The limits, stated plainly
- The count is not the test: it ignores Unclear factors and counts one fact twice where a WP248 criterion and an Art. 35(3) case overlap. Its label is the suite's heuristic: an untouched matrix reads as needing no DPIA, a low count reads softer than the two-criteria rule, and a high one names a prior consultation, which Art. 36(1) ties to residual risk after your measures, not to a number.
- The matrix sits behind a gate that only the Art. 9 and Art. 22 GDPR flags, the three chips and a few sector or DPO inputs open; other WP248 criteria, such as vulnerable data subjects or matching datasets, open nothing. The cockpit then says your inventory 'does not trigger a DPIA obligation': read 'no trigger set', not a finding. A third-country or legal-professional-secrecy entry shuts it for the three chips, though 'Obligations' still lists the DPIA duty.
- One screening at a time: the Risk-Assessment and the tracker each keep one record per browser, not per activity, and Trigger Status pools all entries. Export the matrix before screening the next; the tracker has no file export (all exports).
- Germany only: the joint Art. 35(4) list of the German authorities (DSK) is named, not reproduced; the picker holds the Federal Commissioner and one authority per Land (for Bavaria, the private-sector BayLDA); verify the contact details it shows. No consultation letter is generated.
- The EDPB's harmonised DPIA template (consultation closed 9 June 2026) was not final at our review; the suite does not follow it.
Frequently asked questions
What are the nine EDPB criteria, and does meeting two of them require a DPIA?
As a rule of thumb, yes: WP248 rev.01 says processing meeting two criteria will in most cases need a DPIA, and one can be enough. The nine: evaluation or scoring; automated decisions with legal or similar effect; systematic monitoring; sensitive or highly personal data; large scale; matching datasets; vulnerable data subjects; innovative technology; processing that bars people from a right, service or contract.
What must a DPIA contain under Article 35(7)?
Four elements at least: a systematic description of the processing and its purposes (Art. 35(7)(a) GDPR), an assessment of necessity and proportionality (b), of the risks to data subjects (c), and the measures to address them, safeguards included (d). A designated data protection officer (DPO) must be asked for advice (Art. 35(2)).
When do I have to consult the supervisory authority under Article 36?
Before processing, when the DPIA shows a high risk that your measures cannot bring down (Art. 36(1) GDPR, Recital 84). Where it sees an infringement, the authority gives written advice within up to eight weeks of receipt, extendable by six (Art. 36(2)). The request must include the DPIA (Art. 36(3)(e)).
How is a DPIA different from a FRIA under the AI Act?
Different test, same facts, often the same company. The DPIA (Art. 35 GDPR) binds the controller and looks at risks to data subjects; the FRIA (Art. 27 AI Act) binds certain deployers of Annex III high-risk AI systems from 2 December 2027 (Regulation (EU) 2026/1744) and complements an existing DPIA (Art. 27(4)). More in the cross-regulation collision map.
Do I need a DPIA for AI tools?
Not automatically, but often. Art. 35(1) GDPR singles out new technologies and WP248 counts innovative use as a criterion; an AI tool that scores, ranks or decides about people usually meets a second. Art. 35(4) lists can settle it: the German one names AI that evaluates people or steers interaction with them. Screen each use case; the suite holds one matrix at a time.
Where the screening ends and the assessment begins
The DPIA tool records that the questions were asked; it cannot say whether your processing is likely to result in a high risk, whether your measures bring the residual risk below that line, or whether Art. 36 sends you to an authority. The law firm Theo Funk can review the screening, the draft and the consultation question under a separate mandate; Regingada UG gives no legal advice.
For controllers and processors outside the Union caught by Art. 3(2) GDPR, Regingada UG can be appointed GDPR Article 27 representative, the address in the Union for authorities and data subjects (Art. 27(4) GDPR). The role does not include reviewing your DPIA.