Run a DPIA

Select Open DPIA. Open an impact assessment needs only an Assessment title; it opens as Draft, and the rest can be filled in as the assessment progresses:

• Linked RoPA activity, the processing activity being assessed, or Standalone DPIA for one that spans several;
• Description of operations & scope, Necessity & proportionality and Overall mitigation summary;
• Reviewer, typically your DPO, and the Residual risk: Low, Medium, High or Unacceptable.

Linking a high-risk activity to any assessment that isn't archived, a draft included, clears that activity's Needs DPIA flag on the RoPA tab. Archiving the assessment brings the flag back.

Under Risks & mitigations, select Add risk for each risk to data subjects, with its Level, Likelihood, Severity and Mitigation. Article 35(7) asks the assessment to describe the processing, assess its necessity and proportionality, assess the risks, and set out the measures that address them.

The drawer offers the moves the assessment's status allows:

• Move to review marks it Under review and records today as its review date.
• Approve marks it Approved and starts the annual review clock: the next review falls due a year later.
• Send back for revision marks it Needs revision.

Only the assigned reviewer can approve an assessment or send it back, so assign one before review. Edit and Archive assessment are in the row's menu. An archived assessment stays on the register, read-only, and can't be brought back.

An assessment that isn't archived and whose residual risk is High or Unacceptable counts toward the Prior consultation tile. Article 36(1) requires you to consult the supervisory authority before processing where a DPIA indicates the processing would result in a high risk without measures to mitigate it. The platform flags the assessment; the consultation is yours to make.

Export Article 35 downloads the register as a CSV such as article-35-2026-11-04.csv, with Title, Linked RoPA, Status, Description, Necessity, Measures, Residual risk, Prior consultation, Reviewer, Approved and Next review. Values are the register's own codes, and Reviewer holds the reviewer's user ID rather than their name. One export carries up to 100 assessments; a larger register is refused rather than cut short.