The whole DPIA lifecycle, in one governed loop

Assessment creation & triage

Universal plus sector- and scenario-filtered questions with branching. The engine computes a score, applies compound and severe-trigger rules, and produces a routed outcome with a plain-English rationale. Reviewers can override with a recorded comment.

DPIA completion

Sections show dynamically based on triggers — AI/ADM, monitoring, Article 9/10, transfers, suppliers, children/vulnerable people, PECR advisory. Core sections always appear, fields pre-populate from triage, and critical incomplete sections block submission.

Risk, by-design & evidence loop

Answers generate suggested risks (accept / edit / reject), scored against your matrix with initial and residual bands. Findings generate by-design actions and evidence requirements. High residual risk requires senior acceptance; missing critical evidence blocks approval.

Review, approval & report

Draft → in progress → awaiting evidence → awaiting DPO review → returned / approved / approved with conditions / escalated / rejected. On approval, the assessment snapshots the rule and matrix versions in force and generates a locked, versioned report.

ROPA maintenance

Personal-data processing creates or updates a draft ROPA record pre-populated from triage and DPIA. The owner confirms or edits; the record carries status, review date, links to the DPIA, by-design actions and risks, with overdue and incomplete flags surfaced on the dashboard.