Free DPIA Tools and Templates Compared (2026)

Several regulators publish free DPIA templates, two publish free software, and a number of online tools will generate or draft a DPIA at no cost. They differ in jurisdiction, screening support, drafting functions and how information is handled. This page describes each one from its publisher's own page, as checked on 10 November 2026, including our own tool.

Templates from regulators

ICO sample DPIA template (UK). A Word document with seven steps, from identifying the need for a DPIA to signing off the outcome, each with the questions the ICO expects you to answer. It scores risk on the ICO's scales (likelihood remote, possible or probable; severity minimal, significant or severe; overall risk low, medium or high) and records the residual risk after measures. Step 1 records why a DPIA is needed; the ICO provides separate screening checklists in its guidance. The ICO says "You don’t have to use this template", provided your format covers all the key elements of the process. When checked, the guidance carried a notice that it is under review because of the Data (Use and Access) Act. Our guide to completing the ICO template goes through it step by step.

Irish Data Protection Commission sample DPIA template (Ireland). A PDF with the same seven-step structure and the same risk scales as the ICO template, with references to the DPC, for example "If accepting any residual high risk, consult the DPC before going ahead". The DPC's guidance page links to its list of processing that requires a DPIA. The DPC describes the template as "for use as a guide only". Our guide to DPIAs in Ireland covers the DPC's list.

EDPB DPIA template (EU). A Word template with a PDF explainer, adopted as version 1.0 on 10 March 2026 for public consultation, which ran from 14 April to 9 June 2026. On 10 November 2026 the EDPB's page still offered version 1.0 and showed no final version. The EDPB says it is "not mandatory for organisations to use the EDPB template". It records the reasons for the DPIA by checkbox, and lets the controller choose its own risk method, recording likelihood, severity, risk level and residual risk. Our article on the EDPB template explains it section by section.

Software from regulators

CNIL PIA software (France). Free, open-source software from the French regulator, available as a desktop application for Windows, Linux and macOS and as a web version you install on your own servers. The current release when checked was version 4.1.1, published on 9 November 2026, and the CNIL's French page says it is available in 20 languages, including English. It guides users through the CNIL method with a contextual legal and technical knowledge base, risk visualisation and reusable assessment models. It follows the CNIL's method under the EU GDPR.

AEPD Gestiona RGPD (Spain). A free tool from the Spanish regulator that runs in your browser, "without any transmission of data to the AEPD". It manages a record of processing, assesses "the obligation (or convenience) of carrying out a DPIA", and suggests privacy measures for each risk factor from a catalogue the AEPD says has grown to almost 800. Reports can be produced in doc, html and csv formats. It is written for the GDPR and Spanish data protection law, and the AEPD notes that using it does not in itself amount to carrying out a DPIA.

Online tools

Gera Tools, AI DPIA template generator. A free browser tool that "runs free in your browser on Gera Tools, with nothing uploaded". It maps your answers against the Article 35 high-risk indicators and lists those that apply. Your answers fill in the header and the summary of triggers; in the publisher's words, "the narrative sections are scaffolded with prompts for you to complete". It exports Markdown. It is written for AI processing under the GDPR; UK GDPR and the ICO are not mentioned.

KLA Digital, DPIA + FRIA generator. A free browser tool that combines a GDPR Article 35 DPIA with the fundamental rights impact assessment required of some deployers of high-risk AI systems under Article 27 of the EU AI Act. The publisher says "Everything stays in your browser. Nothing you type is uploaded". It provides a structured form, a risk register and a worked example; you write the content. It exports Markdown and JSON. The form shown on the page contains no separate screening stage and links to guidance on when a DPIA is needed.

BlockSurvey, AI impact assessment generator. A free tool, with "no account" and a fair-use limit, that drafts an AI impact assessment, described by BlockSurvey as "an AI-specific version of a data protection impact assessment (DPIA)". BlockSurvey describes the generated assessment as intended to align with GDPR impact-assessment expectations and ISO/IEC 42001 management-system requirements. It writes the full text with a language model, so what you enter is sent to BlockSurvey's server; the page says entries "are never stored, sold, or used for training". The result downloads as Word or PDF. BlockSurvey's page states that "it does not verify that your practices match what the assessment says".

Rocket Lawyer, Data Protection Impact Assessment (UK). An online questionnaire that builds a DPIA document from your answers, written for UK GDPR and the Data Protection Act 2018, for use "where personal data is not being transferred outside of England, Wales and Scotland". The document includes a risk assessment with likelihood, severity and overall risk. The page invites you to make a free DPIA and to "get Rocket Lawyer FREE for 7 days"; membership costs £34.99 a month after the trial unless cancelled. Whether a finished document can be downloaded without a membership is not stated.

A template from a law firm

Bratby Law, DPIA template (UK). A free Word template from an SRA-regulated law firm, downloadable without signing up, last updated in July 2026. It begins with a threshold assessment for you to complete, recording whether a DPIA is required, and scores risk on a five-by-five scale (likelihood multiplied by severity, from 1 to 25), before and after mitigation. The content is written by you: "Replace every bracketed prompt with your facts."

Our tool

Janus Compliance, DPIA tool. Our DPIA tool asks about the project and jurisdiction before screening whether a DPIA is required, under UK GDPR with the ICO's list, under the EU GDPR as applied in Ireland with the DPC's list, or both. It then asks about the project one question at a time, reads documents you add and asks you to confirm what it took from each, and drafts each section as you answer, including a risk register scored for likelihood and severity and the decisions your organisation records. The tool is designed to record unknown information as unconfirmed. It is free to complete, and the finished DPIA downloads as a Word document for £39; it is in beta.

The conversation, documents and draft are kept in your browser. Each message sends the conversation so far through our server to Anthropic to produce the reply; our server does not retain it as part of that exchange. If you request a private link to continue on another device, your browser encrypts the assessment and an encrypted copy is stored with Vercel in Dublin. You can delete that copy from the tool; otherwise a daily job deletes it once 30 days have passed since the last save. Our privacy policy explains this storage and Anthropic's retention periods and exceptions. Like any drafted text, the result has to be checked against your own records.

Summary

	Written for	Cost	Screening	Writes text	What you enter
ICO template	UK GDPR	Free	Records why a DPIA is needed; separate screening checklists	No	Downloadable Word file; storage depends on how you use it
DPC template	EU GDPR, Ireland	Free	Records why a DPIA is needed; guidance links to the DPC list	No	Downloadable PDF; storage depends on how you use it
EDPB template	EU GDPR	Free	Records the reasons by checkbox	No	Downloadable Word file; storage depends on how you use it
CNIL PIA	EU GDPR, CNIL method	Free, open source	Not stated on the reviewed product page	Guided completion with knowledge base and reusable models	Desktop, or your own server
AEPD Gestiona RGPD	GDPR, Spain	Free	Yes	Suggests measures	Stays in your browser
Gera Tools	GDPR	Free	Lists matching high-risk indicators	Header and triggers only	Stays in your browser
KLA Digital	GDPR and EU AI Act	Free	No separate stage shown	No	Stays in your browser
BlockSurvey	GDPR and ISO/IEC 42001	Free, fair-use limit	Not stated on the reviewed product page	Yes	Sent to BlockSurvey's server
Rocket Lawyer	UK GDPR	Seven-day membership trial; then £34.99/month unless cancelled	Not stated on the reviewed product page	Builds the document	Stored in your account
Bratby Law template	UK GDPR	Free	Includes a threshold assessment for you to complete	No	Downloadable Word file; storage depends on how you use it
Janus Compliance tool	UK GDPR and EU GDPR (Ireland)	Free to complete, £39 to download	Yes	Yes	Browser storage; conversation sent through our server to Anthropic; optional encrypted server copy

Choosing between them

Start by identifying which law applies to the processing under Article 3 of the UK GDPR or EU GDPR. Relevant factors include the organisation's establishments and whether processing relates to offering goods or services to people in the UK or EU, or monitoring their behaviour there. Both regimes can apply. For EU processing, identify the competent supervisory authority and any applicable national requirements; serving people in Ireland does not by itself make the DPC the lead supervisory authority.

Then decide whether you want a structure to complete yourself or a tool that drafts text from your answers. The templates provide questions and prompts for you to complete. A drafting tool does more of the writing but has to be checked against the facts, and it is worth reading where your answers are sent before you enter details of a real project.

Article 35(7) sets minimum requirements under both regimes. Describe the planned processing systematically, explain its purposes and identify any legitimate interest relied on. Assess whether the processing is necessary and proportionate to those purposes, and evaluate its risks to individuals' rights and freedoms. Record the proposed safeguards, security measures and other arrangements for addressing those risks, protecting personal data and demonstrating compliance, taking account of the rights and legitimate interests of the people concerned.

Each description above was checked on its publisher's own page on 10 November 2026. If anything has changed, please tell us and we will update the page.