The Janus DPIA tool in one page
The project owner supplies the facts and documents. The tool drafts an editable Word assessment for the privacy team’s review and the organisation’s approval. Download this summary as a one-page PDF.
What it is
A web tool that helps an organisation carry out a data protection impact assessment (DPIA) under UK GDPR and Irish law. The project owner adds the documents they have and answers plain questions. The tool drafts the assessment. The privacy team reviews it, and the organisation approves it.
What the project owner does
They add the documents they have (PDF, Word .docx, or PNG, JPEG, GIF and WebP images) and answer the tool’s questions in plain English. The tool tells them what it has taken from each document and asks them to confirm it. They need no knowledge of data protection law, and they can stop and come back later.
What comes back
An editable Word document containing:
- A summary after the cover: the document status, totals of recorded risk scores, and extracts from or references to the screening and outcome sections
- Screening: whether a DPIA is required, with the reasons
- Description of the processing, including the data flows
- Lawful basis and conditions for each purpose
- Necessity and proportionality
- Consultation: the data protection officer’s advice where one is designated, and the views of the people affected or the reason they were not sought
- Risk register: the scoring definitions, then each risk scored for likelihood and severity, with its measures, residual risk, owner and date
- AI systems, where the project uses AI
- Outcome and actions: the decisions you have recorded and the points still to resolve
- Documents relied on and assumptions, and a sign-off section
The method page sets out how the tool decides whether a DPIA is required, what it must contain and how risks are scored (method version 0.5.20).
Who is accountable
Your organisation, as controller, and the tool is built around that. It drafts and explains, while the decisions on risk, measures and whether to go ahead are recorded as your organisation’s decisions. It downloads as an editable Word document for review and approval by your organisation, with sections for the data protection officer’s advice and the controller’s sign-off.
What happens to the information provided
The conversation, the documents and the draft are kept in the user’s browser. Each message sends the whole conversation so far, including uploaded PDFs and images and the text of Word documents, over an encrypted connection through our server in Vercel’s Dublin region to Anthropic, the provider of the AI model. The server does not keep the conversation. If the user asks for a private link to continue on another device, an encrypted copy is also stored with Vercel in Dublin; the user can delete it, and otherwise it is deleted once 30 days have passed since the last save. Anthropic acts as our processor, does not use the content to train its models, and normally deletes it within 30 days; the privacy policy explains the exceptions. It may process content in the United States, under the standard contractual clauses and the UK Addendum. For assessment content, Janus acts as your processor under Article 28 terms.
How the draft is kept accurate
In two ways. The tool is instructed to take the law from a written method drawn from the legislation and the regulators’ guidance, with the UK and Irish rules kept separate, and the method version is printed on each document. An automated check then looks for unsupported statements in each drafted section and in the risk register, using the conversation, the document summaries the user confirmed and the written method. Its findings are returned for correction, and statements that remain flagged are shown to the user for review. Your team’s review is the final check.
Is it legal advice?
No. It is a drafting tool for your team’s assessment. Where a point needs a lawyer’s judgment it says so, and a review by a CIPP/E certified privacy professional is available from £120.
Who built it
Michael K. Onyekwere, CIPP/E, a common law qualified lawyer with over nine years of data protection experience in regulated financial and professional services.
What it costs
The tool is free to complete, and a finished DPIA downloads as a Word document for £39. A team licence costs £2,400 a year for up to 3 named users and 40 assessments, and a group licence costs £4,800 a year for up to 10 named users and 120 assessments, each invoiced to your organisation. A free 30-day pilot covers two real assessments and a call with Michael to go through the output.
Where to read more
The tool terms include the processing terms, and the privacy policy describes the data handling in full. Contact us to discuss your security and procurement requirements or to ask for a pilot.