An asset-by-asset review of every processing activity in scope — not a selective check run only on the activities assumed to carry risk. Each activity is tested for whether a DPIA is genuinely warranted, including validating any activity your own team has already marked as exempt, before the deeper risk work happens only where it's actually needed.
The assessment starts from the asset, works through every processing activity tied to it, and confirms applicability before any deep-dive risk work begins.
The assessment starts from the specific asset or application, scoped and introduced before any processing activity within it gets touched.
Every processing activity tied to that asset, listed in full, not just the ones assumed upfront to be risky.
For each activity, whether a third-party processor is involved, and to what extent.
Whether existing documentation for each activity is actually sufficient, or has real gaps once someone looks closely.
Every processing activity is tested against DPIA triggers, including validating any activity already flagged as "DPIA not needed" rather than accepting that call at face value.
Necessity & proportionality, risk-to-rights, and mitigation design — run only on the activities confirmed to actually need it.
Every finding traces back to a specific processing activity — nothing is bundled into a single pass/fail for the entire asset.
Data flow mapping and risk mapping run as two distinct steps — a scored risk register depends on the flow map being done first.
Share the DPIA intake template for your team to complete and return.
Covers asset, every processing activity tied to it, processor involvement, and existing documentation — one template, filled once, per asset.
Confirm which submitted activities genuinely warrant a full DPIA.
Any activity already marked exempt by your team is tested here too, rather than accepted at face value.
Map how data actually moves for every activity confirmed in scope.
Systems, storage points, and transfers — the concrete map that risk scoring depends on.
Identify and score the risk to Data Principals for each in-scope activity.
Scored as risk to the individual, not organisational or reputational risk — kept as its own step from flow mapping.
Deliver mitigation recommendations mapped to each identified risk.
Each recommendation gets an owner, so the finding doesn't stall as an unassigned line item.
Start with the intake template — 30 minutes to scope it, no obligation.
Book a Consultation