Dynamic DPIA™ · European Union
Article 35 applies now. The harmonised template does not exist yet.
The EDPB’s harmonised DPIA template is still in draft. That is an awkward thing to put on a product page, and the alternative — implying we fill an official form that has not published — is worse. We build against the requirements in Article 35 itself.
The honest position
What we build against while the template is draft.
Article 35(7) sets out what a DPIA has to contain. Those requirements are in force whatever form eventually carries them, so that is what the document is structured from.
The statutory requirements, structured
A systematic description of the processing and its purposes; an assessment of necessity and proportionality; an assessment of the risks to the rights and freedoms of data subjects; and the measures envisaged to address those risks. Written to the statute, not to a guess at a layout.
Cited to provision, like everything else
The duty set for your deployment comes from the corpus, with each obligation carrying the provision it was determined from.
Supervisory authority varies, and the document reflects that
The EU is not one regulator. Your lead authority, and the national guidance that applies alongside the Regulation, differ by establishment — a document that ignores this reads as though it was written for somewhere else.
When the template publishes, the substance transfers
Because it was written against Article 35 rather than against somebody’s mock-up of a form, the work moves across instead of being redone.
We bring the regulatory intelligence and the intake. You bring the privacy and legal judgment for your use case and organization. The document is built to hold both.
The division of labour, stated onceWhat this is not. LegisGate produces regulatory intelligence and assessment-preparation materials. Nothing we produce is legal advice, a legal opinion, a certification, or a determination of compliance, and no document we deliver satisfies a legal obligation on its own. Sufficiency is determined by your counsel. A completed DPIA from us does not satisfy Art. 35, and nothing here is an official EDPB assessment or score.
Free tool
Already have a DPIA? See how it maps.
The EDPB Converter takes a DPIA you have already written and remaps it into the draft EDPB structure as a working document, with an advisory present / thin / absent view of where the substance sits.
It is advisory and it is not scoring. The draft template can still change, and a tool that produced a confident number against a document that has not been finalised would be inventing precision it does not have.
Template watch
We will tell you when it publishes.
Leave an address and you get one message when the EDPB harmonised DPIA template moves from draft to final — and a second if the change is material enough to affect documents already written against the draft.
EU or UK?
They are different instruments, and the document should know which one it is.
If you operate in both, you need both — and a single document labelled for the wrong one is a mistake a reviewer spots on the cover page.
European Union
Built against the statutory requirements while the EDPB harmonised template remains draft. Lead supervisory authority reflected.
UK GDPR · DPA 2018United Kingdom
Filled into the ICO’s own published template, field by field. The straightforward case, because the regulator settled the format.
Article 35 did not wait for the form
The obligation is live. Start from the statute.
A document built against the requirements survives the template landing. One built against a guess at the layout does not.