LegisGate · DPIA · European Union
Article 35 of the GDPR requires a data protection impact assessment for certain processing. In LegisGate the determination says whether your AI use case is one of them. If it is, the DPIA is already open on the use case as a working page: the regulatory half written and cited, and your half laid out as guided questions.
How a DPIA is done in LegisGate
You add the AI use case and answer about 15 minutes of intake. Everything below follows from those answers, and nothing is asked twice.
Article 35 applies on conditions, and plenty of AI use cases do not meet them. The determination tests yours against those conditions. If a DPIA is not required, you have the dated record saying so, which is the document you actually needed.
Where a DPIA is required, it is opened as a draft when the determination runs. There is nothing to request and nothing to buy. There is one DPIA for each AI use case, covering the EU, the UK, or both, as the use case reaches them; the version you choose decides which authority’s template it follows.
Each section opens with what your intake already answered and the findings that belong to that section, each cited to the provision it comes from, and the risk statements where the section has them. That half is read-only.
Your half is laid out as guided questions, section by section: the description of the processing, necessity and proportionality, the risks to data subjects, the measures against them, the DPO consultation, the prior-consultation determination, and the sign-off. Each question shows why it is asked, with the article that requires it linked to the source text, and a Guidance block quoting the ICO.
Assign a question, or a whole section, to a teammate with a due date, or invite a contributor by email for the questions that are theirs. A contributor creates a password from the link and sees only the questions assigned to them. Each answer is Open, Answered, In review, then Accepted, or Returned with a note.
The assessment register lists each risk the determination raised. Your organisation rates it, before and after the measures against it, and a measure you commit to becomes an obligation with an owner and a due date. The DPIA exports as a Word document in the ICO sample template, the EDPB template structure, CNIL and other versions, with a status line on its cover saying how many questions are accepted and whether it has been reviewed. Mark reviewed records who reviewed it and when; it does not say the assessment is sufficient.
Monitoring is included and automatic: when the law behind a question changes, that question is flagged, and the activity log records who answered, accepted, assigned and exported.
Your first five AI use cases are free, with everything included: the laws, the obligations, the written assessments and monitoring. No card. More than five is a subscription.
What it looks like
The sections run down the side with how many questions in each are accepted. The section you open shows our half folded above your questions.
We bring the regulatory intelligence and the intake. You bring the privacy and legal judgment for your use case and organization. The document is built to hold both.
The division of labour, stated onceThe EU position
The EDPB’s harmonised DPIA template (version 1.0, adopted 10 March 2026 for consultation) is not yet final. Article 35(7) already says what a DPIA has to contain, so that is what the questions are built from.
Written to the statute, not to a guess at a layout
A systematic description of the processing and its purposes; an assessment of necessity and proportionality; an assessment of the risks to the rights and freedoms of data subjects; and the measures envisaged to address those risks.
The same answers, in more than one version
The EU is not one regulator, and authorities publish their own templates. You choose the version you work to, and choosing another does not mean answering again.
When the template is final, the substance carries across
Because the answers are kept as answers and not as a filled-in file, they move to the final form instead of being redone. Whether an assessment needs to change when that happens is a call for your counsel.
What this is not. LegisGate produces regulatory intelligence and assessment-preparation materials. Nothing we produce is legal advice, a legal opinion, a certification, or a determination of compliance, and no document we deliver satisfies a legal obligation on its own. Sufficiency is determined by your counsel. A completed DPIA from us does not satisfy Art. 35, and nothing here is an official EDPB assessment or score.
Free tool
The EDPB Converter takes a DPIA you have already written and remaps it into the EDPB template structure as a working document, with an advisory present / thin / absent view of where the substance sits.
It is advisory and it is not scoring. The template can still change, and a tool that produced a confident number against a document that has not been finalised would be inventing precision it does not have.
EU or UK?
If you operate in both, the same DPIA covers both, and the version says which authority’s template it follows.
Article 35 did not wait for the form
Add the AI use case. If a DPIA is called for, it is open with our half written before you have finished reading the determination. Your first five AI use cases are free.
