Assess risks systematically and conduct Data Protection Impact Assessments under Art. 35 GDPR as well as Transfer Impact Assessments (TIA) under Schrems II in a guided and structured manner – with AI suggestions for the risk catalogue and countermeasures. Graphical risk mapping visualizes your assessments.
DPIA
Create DPIAs for high-risk processing activities. The structured form guides you through all required steps. Every DPIA receives a clear assessment status – acceptable, act/review, or unacceptable – as the basis for your decision. Link the DPIA with processing activities and automatically adopt numerous details. Automatic revision of all approved documents.
Transfer Impact Assessment
Conduct Transfer Impact Assessments for data transfers to third countries. Assess the legal situation in the destination country, verify the effectiveness of SCCs and BCRs, and document additional safeguards. The form follows the recommendations of the European Data Protection Board. On approval, an immutable revision is created that you can export as PDF or DOCX – ready to use as evidence for supervisory authorities.
Risk Analyses
Create risk analyses for various purposes – from protection needs assessments to threshold analyses to supplier qualifications. Graphical risk mapping visualizes likelihood and severity in a risk matrix. Define risk mitigation measures with responsible persons and deadlines.
Features
From DPIA to TIA to free-form risk analysis – all the tools for systematic risk assessment.
Automatic adoption of data categories, affected persons, and legal bases. No duplicate data maintenance.
Documentation of end-to-end encryption, pseudonymization, or contractual supplementary agreements with effectiveness assessment.
All DPIAs, TIAs, and risk analyses centrally in filterable overviews. Status, destination country, risk assessment, and last review at a glance.
Upon approval, a new revision is automatically created. Reminders prompt you for regular reviews when the legal situation changes. For TIA and DPIA a revision is created with every save into the statuses Acceptable, Act/Review and Unacceptable.
Export as PDF or DOCX with all assessments and graphical risk mapping. Directly usable for audits and authority evidence.
FAQ
Yes. The structured form guides you step by step through the DPIA, adopts data categories and legal bases from the linked processing activity, and uses AI to suggest an assessment of necessity under Art. 35(1) GDPR, a risk catalogue, and appropriate countermeasures. A graphical risk matrix visualises likelihood and severity; on approval an immutable revision is created as PDF or DOCX. In addition, a TIA form following the EDPB recommendations guides third-country transfers including the Schrems II assessment.
A suitable DPIA tool should map the impact assessment as a guided process under Art. 35 GDPR, adopt data from the record of processing activities instead of duplicating it, and document the result in a revision-safe way. preeco | data protection delivers all of this: the DPIA is directly linked to the processing activity, the threshold analysis in the processing activities supports the prior check of necessity, the AI suggests a risk catalogue and countermeasures, and the graphical risk matrix makes likelihood and severity visible. Every approval creates an immutable revision – auditable for supervisory authorities.
A DPIA is required when the planned processing is likely to result in a high risk to the rights and freedoms of natural persons – for example with systematic and extensive automated decision-making with legal effect, large-scale processing of special categories under Art. 9 GDPR, or far-reaching scoring. preeco | data protection supports the prior check with the threshold analysis in the processing activities; the AI additionally suggests an assessment of necessity under Art. 35(1) GDPR. The final legal assessment remains with the controller.
On your own documentation: the linked processing activities, processing on behalf of a controller and technical and organizational measures are taken into account. From these, the AI suggests in the edit form an assessment of necessity, a structured risk catalog and matching countermeasures. You accept, change or discard the suggestions, and every AI activity is logged with function, user, model and status. The assessment remains the responsibility of your team.
When you transfer personal data to a third country on the basis of appropriate safeguards under Art. 46 GDPR, such as standard contractual clauses. The form follows the recommendations of the European Data Protection Board: the legal situation in the destination country, the effectiveness of the safeguards and supplementary measures. Purpose and data categories are taken over from the linked processing activities. The AI deliberately drafts the assessment of the legal situation as a neutral draft for your own review.
The status records the outcome of a DPIA or TIA: the residual risk is acceptable, there is a need to act or review, or the processing is unacceptable in its current form. Every save into one of these statuses automatically creates a revision. This lets you prove later which assessment applied at what time, and two versions can be compared with the changes highlighted in color.
Any kind, for example protection requirements analyzes, resource assessments, threshold analyzes or threat analyzes. You define events, damage ratings and risk levels yourself. A risk analysis can be created on its own or linked to a document and assigned to users to answer; the permission concept separates answering from editing. You download the results as PDF or DOCX with a graphical representation of the risks.
We will show you how preeco | data protection fully covers your risk analyses and impact assessments.