Loading page
About this tool
Score a new feature's privacy risk and outline the structure of a Data Protection Impact Assessment (DPIA).
The DPIA Starter Wizard turns a short description of a new feature into a first-pass privacy risk rating out of 11 and the outline of a data protection impact assessment. It scores processing scale, whether sensitive data or vulnerable people are involved, and whether the data touches high-risk categories such as location, biometrics, health, children, financial data or profiling, then subtracts credit for up to three safeguards you list. Privacy, product and engineering teams get a structured starting point and a Lower, Medium or High initial rating before the formal assessment begins.
Open DPIA Starter Wizard on AltFTool — it loads instantly in your browser.
Fill Feature or project, Personal data involved and Affected people, then set Scale to Small / limited, Medium or Large / systematic — the Location feature example chip fills all four.
Tick 'Includes sensitive data or vulnerable people' where it applies and list your controls in Existing safeguards, separated by commas, semicolons or new lines; each one subtracts a point, to a maximum of three.
The Result panel returns Lower, Medium or High initial privacy risk with a Risk score row out of 11 and the five DPIA sections still to write; Copy takes the summary, Download saves dpia-starter-wizard.txt.
Each mitigation you list reduces the risk score, up to three, so the rating reflects the controls you have already built rather than the raw data alone.
Mentioning location, biometrics, health, children, financial data, tracking or profiling adds to the score automatically, matching the categories regulators single out.
The output lists the parts a scan cannot do for you — necessity and proportionality, data flow mapping, risks to people, mitigation owners, and the review schedule.
Under GDPR Article 35 a DPIA is required whenever processing is likely to result in a high risk to people's rights and freedoms, and is explicitly required for systematic large-scale evaluation or profiling with significant effects, large-scale processing of special-category data, and systematic large-scale monitoring of publicly accessible areas. European guidance treats meeting two or more of its nine high-risk criteria as a strong signal that one is needed; confirm the position with your DPO or privacy counsel.
Scale contributes 1 for small, 2 for medium and 4 for large or systematic processing; sensitive data or vulnerable people adds 4; a high-risk data category adds 3; and each listed safeguard subtracts 1 up to a maximum of 3. The total runs to 11, with 7 and above rated High and 4 to 6 rated Medium.
No, it means the feature needs a full assessment and documented mitigations before it proceeds. If a completed DPIA still shows high residual risk that you cannot reduce, GDPR Article 36 requires you to consult your supervisory authority before starting the processing.
No. It is a structured starter that captures the feature, data, affected people and safeguards and gives an initial rating, but a real DPIA also documents necessity and proportionality, the full data lifecycle, risks to individuals, named mitigation owners and formal sign-off. Have a qualified privacy professional complete and approve it.