Where a DPIA usually stalls
A privacy team can write a DPIA. What takes the weeks is getting the facts out of the project: what the system does, which supplier holds the data, what the contract says, who decided what. The template goes to the project owner, comes back half complete, and the assessment is still open when the system goes live.
The tool is built for that part of the work. It asks the project owner one plain question at a time, and it reads the documents they already have, such as the supplier’s contract or the project plan, so that the draft starts from the facts.
How it works for your team
- The project owner supplies the facts. They add the documents they have (PDF, Word .docx, or PNG, JPEG, GIF and WebP images) and answer the tool’s questions in plain English. The tool tells them what it has taken from each document and asks them to confirm it. They need no knowledge of data protection law, and they can stop and come back later.
- The tool drafts as they answer. It screens whether a DPIA is required, then writes each section beside the conversation, using its written legal method and an automated check that looks for statements the project owner’s answers do not support.
- Your team reviews, and your organisation approves. The assessment downloads as an editable Word document with the open points listed, the decisions recorded as the organisation’s own, and sections for the data protection officer’s advice and the controller’s sign-off.
What your team gets back
- Screening: whether a DPIA is required, with the reasons
- Description of the processing, including the data flows
- Lawful basis and conditions for each purpose
- Necessity and proportionality
- Consultation: the data protection officer’s advice where one is designated, and the views of the people affected or the reason they were not sought
- Risk register: each risk scored for likelihood and severity, with its measures, residual risk, owner and date
- AI systems, where the project uses AI
- Outcome and actions: the decisions you have recorded and the points still to resolve
- Documents relied on and assumptions, and a sign-off section
The method page sets out how the tool decides whether a DPIA is required, what it must contain and how risks are scored (method version 0.5.16).
The questions a privacy team asks first
Who is accountable for the assessment?
Your organisation, as controller, and the tool is built around that. It drafts and explains, while the decisions on risk, measures and whether to go ahead are recorded as your organisation’s decisions. It downloads as an editable Word document for review and approval by your organisation, with sections for the data protection officer’s advice and the controller’s sign-off.
What happens to the documents and answers we provide?
The conversation, the documents and the draft are kept in the user’s browser. Each message sends the whole conversation so far, including uploaded PDFs and images and the text of Word documents, over an encrypted connection through our server in Vercel’s Dublin region to Anthropic, the provider of the AI model. The server does not keep the conversation. If the user asks for a private link to continue on another device, an encrypted copy is also stored with Vercel in Dublin; the user can delete it, and otherwise it is deleted once 30 days have passed since the last save. Anthropic acts as our processor, does not use the content to train its models, and normally deletes it within 30 days; the privacy policy explains the exceptions. It may process content in the United States, under the standard contractual clauses and the UK Addendum. For assessment content, Janus acts as your processor under Article 28 terms.
How does the tool keep the draft accurate?
In two ways. The tool is instructed to take the law from a written method drawn from the legislation and the regulators’ guidance, with the UK and Irish rules kept separate, and the method version is printed on each document. An automated check then looks for unsupported statements in each drafted section and in the risk register, using the conversation, the document summaries the user confirmed and the written method. Its findings are returned for correction, and statements that remain flagged are shown to the user for review. Your team’s review is the final check.
What does the draft contain for our review?
The document follows what Article 35 and the ICO’s and the Data Protection Commission’s guidance ask a DPIA to contain: the screening and its reasons, the description of the processing, lawful basis, necessity and proportionality, consultation, a scored risk register with measures, residual risk, owners and dates, and the outcome. The draft includes sections for unresolved points and the organisation’s decisions.
Which law does it apply?
UK GDPR with the ICO’s list of processing that requires a DPIA, the EU GDPR as applied in Ireland with the Data Protection Commission’s list, or both where both apply. It asks where the organisation is established and where the people affected are before it decides.
Is it legal advice?
No. It is a drafting tool for your team’s assessment. Where a point needs a lawyer’s judgment it says so, and a review by a CIPP/E certified privacy professional is available from £120.
The tool terms include the processing terms, and the privacy policy describes the data handling in full. Contact us to discuss your security and procurement requirements.
Who built it
Michael K. Onyekwere, CIPP/E, a common law qualified lawyer with over nine years of data protection experience in regulated financial and professional services. He owns a second-line privacy programme covering several jurisdictions and prepares DPIAs as part of that work. The method is written from the legislation and the regulators’ guidance and is reviewed whenever the law changes.
What it costs, and how to start
Per assessment
£39
Free to complete. Pay when you download a finished DPIA as a Word document.
Team licence
£2,400
A year. Up to 3 named users and 40 assessments, invoiced to your organisation.
Group licence
£4,800
A year. Up to 10 named users and 120 assessments, invoiced to your organisation.
Both licences cover your organisation and the group companies listed in the order form, with the allowance shared across them. A free 30-day pilot covers two real assessments and a call with Michael to go through the output. Janus Compliance Limited is not currently registered for VAT, so none is added.