No account needed. Answer the questions, pay securely, and receive your deliverable.
Name shown on the deliverable
Shown on the deliverable.
Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.
Deliverable
You set its title, author and structure.
As it will appear on the result.
Shown as the author of the deliverable; never filled in by the AI.
The processing
One processing activity, or a set of similar ones.
Who decides why and how the data is used.
Function, if one is designated.
From collection to deletion, who does what, with which system, and how many people are concerned.
One row per entry, e.g. “Provide and document medical care; Contract; Article 9(2)(h), care by staff bound by secrecy; Consultation notes, diagnoses; Period set by health rules; Care is the service the patient asks for”
Categories only, never the data itself.
Where, and on which basis. Say so if there are none.
Is a DPIA required?
Select what applies. These are the nine criteria of the WP 248 guidelines; national authorities publish further lists.
Necessity and proportionality
Why this processing, and why this much data.
Could the purpose be reached with less?
What is left out, and who sees what.
How they are told, and how they exercise their rights.
Risks to people
The harm to the people concerned, never a business cost. Rate each risk before and after its measures.
One row per entry, e.g. “A stolen password gives access to records; Phishing; Exposure of health data; Maximum; Possible; MFA, alert on bulk export; Maximum; Unlikely”
Advice and decision
Article 35(2) and 35(9).
Or why they were not sought.
The function that accepts the residual risks.
Anything the service should take into account.
What the AI provider receives
Your answers, to write this deliverable.
Replaced first, then put back in your deliverable: Email addresses, People's names, Company names.
