Impact assessments, prefilled from your own records.
Privacyboard screens each activity of your register against the nine criteria of the European Data Protection Board and tells you when a DPIA is needed. The assessment opens prefilled from your records. Every transfer outside the EEA is sorted, and a transfer impact assessment is run where one is needed. Screening is free; complete assessments come with Pro.
Free to set up · No credit card · About 5 minutes
In short
- Screening
- The nine EDPB criteria, free on every plan
- DPIA
- Five parts, prefilled and marked Suggested until you change them
- Transfers
- Adequacy, Data Privacy Framework or TIA, vendor by vendor
- Plan
- Complete DPIAs and TIAs, with PDF, on Pro and Business
Screened against nine criteria
The criteria your records point to are ticked for you to confirm. Two or more usually mean a DPIA is required, and every decision is dated.
Risks drafted from your tools
Access, change and loss of data, with the impact on people and a suggested severity. You judge the likelihood, before and after your measures.
Every transfer, sorted
Vendors outside the EEA are sorted into adequacy, Data Privacy Framework or TIA needed. The TIA opens with what the vendor publishes, dated and linked.
Where it fits
Everything sits in one workspace: say a thing once, and every document that depends on it follows.
What are a DPIA and a TIA?
A data protection impact assessment (DPIA) is required before processing that is likely to result in a high risk for people. It describes the processing, shows it is necessary and proportionate, rates the risks for people and records the measures that reduce them.
A transfer impact assessment (TIA) applies when personal data leaves the European Economic Area under standard contractual clauses or a similar tool. It checks that the law of the destination does not undermine the protection the clauses promise, following the six steps of the European Data Protection Board.
How it works
- 1
Screen each activity
Tick the criteria that apply. The ones your records point to are ticked for you to confirm. Two or more usually mean a DPIA is required.
- 2
Run the DPIA
Context, necessity, security, risks and conclusion, prefilled from your activities, vendors and security answers. Rate severity and likelihood yourself.
- 3
Assess your transfers
Each vendor outside the EEA is sorted: adequacy, Data Privacy Framework or TIA needed. The TIA opens with what the vendor publishes.
What you get
Nine criteria, suggested
Sensitive data, employees, analytics, advertising or AI tools and optional cookies tick the matching criteria for you to confirm.
One decision per activity
Each screening is dated, including the ones that need no DPIA, so you can show why.
Prefilled from your records
Purposes, data, people, vendors, retention, legal basis and transfers come from your register, marked Suggested.
Three risks, drafted
Illegitimate access, unwanted change and disappearance of data, with impacts, sources and a suggested severity.
Planned measures, dated
What is still missing, such as a DPA to review or a retention period to set, listed with a date three months ahead.
Every transfer sorted
Adequacy, an active Data Privacy Framework entry, or a TIA needed, read from your vendor list.
Government requests, sourced
For about 40 common vendors, what they publish about government requests, with the link and the date we read it.
Kept current
When your records change, the assessment offers to update the answers you left as suggested. Reviews are due yearly.
Where the rules ask for an assessment
An assessment records your own judgement and the measures you chose. It is not legal advice or a certification, and your authority may publish its own list of processing that always needs a DPIA.
- Article 35(1)
- Carry out a DPIA before processing that is likely to result in a high risk to people's rights and freedoms.
- Article 35(7)
- The DPIA describes the processing, assesses necessity and proportionality, assesses the risks and sets out the measures to address them.
- Article 36
- When the residual risk stays high, consult the supervisory authority before starting the processing.
- Article 46 and EDPB Recommendations 01/2020
- Transfers under standard contractual clauses must be assessed against the law of the destination, with supplementary measures where needed.
Say it once. It is true everywhere.
Your vendors, your answers and your cookie banner feed one workspace. Your policy, your records, your agreement and your privacy center are written from it, so a change is made once and nothing drifts.
A European service. Your workspace data is stored in the EU.
Other regimes, such as India’s DPDP Act, are not covered yet. Privacyboard is a guide, not legal advice.
Go online for free. Grow when you need to.
Your privacy center and cookie banner are online on the Free plan. Pro adds your requests, your domains and your team; Business, your brand only and the evidence pack.
Free
$0 forever
No card, no time limit
For getting compliant and going online on your own.
Start for freeKey features:
- Privacy policy and documents drafted for youDrafted from the tools you really use, then reviewed and validated by you: privacy policy, cookie policy, data processing agreement and more.
- Vendor and processing registersYour tools and data activities in one register, with each vendor’s region, agreement and transfer details prefilled from our catalog.
- Privacy requests and breaches trackedEvery request and every personal data breach with its legal deadline and who to notify.
- Impact assessment screeningTells you which activities need a data protection impact assessment, and which transfers need a transfer impact assessment.
- Privacy center at yourcompany.privacyboard.ioYour policy, vendor list and documents on one public page, with your contact address and a “Powered by Privacyboard” mention.
- Cookie banner on 1 domain, 1,000 recorded choices a monthHolds back analytics and marketing tools until visitors agree, with a small Privacyboard link. Beyond 1,000 choices in a month, the banner keeps working but choices are not recorded.
- Real-browser scan of your site, twice a dayOpens your site in a real browser and lists the cookies and tools it finds, so your banner declares them all.
- 1 person
No card needed
ProRecommended
$32 per month
Billed $384 a year Save $84
For taking requests, covering all your sites and working as a team.
Start with ProEverything in Free, plus:
- Request form and replies from PrivacyboardA request form on your privacy center that lands in your inbox, and replies sent from Privacyboard under your company name.
- Your center on your own domainServe your privacy center at an address such as privacy.yourcompany.com, with one DNS record.
- Cookie banner on up to 3 domains, every choice recordedNo Privacyboard mention on the banner, and no monthly limit on recorded choices.
- Weekly scan of your websiteYour site is checked in a real browser every week, and you get an email when a new tool appears.
- Complete DPIAs and TIAsData protection and transfer impact assessments prefilled from your register and vendors, with PDF export.
- Claude and ChatGPT connectorAsk an AI assistant about your workspace: what is overdue, which vendors lack an agreement. Read-only.
- Up to 5 people, with rolesOwner, admin, editor and viewer. Pending invitations count toward the 5.
- Activity log, kept 13 months
- Support by email
Cancel any time
Business
$109 per month
Billed $1,308 a year Save $240
For proving it to customers and auditors, under your brand only.
Start with BusinessEverything in Pro, plus:
- Your brand onlyNo “Powered by Privacyboard” mention on your privacy center.
- Security section and vendor-list alertsShow your certifications and a security contact on your center, and let customers subscribe to an email when you add or remove a provider.
- Evidence pack in one clickOne dated file for audits and customer questionnaires: summary, registers, validated documents, requests, incidents and consent proofs.
- Cookie banner on up to 10 domains
- Daily scan of your websiteEvery day instead of every week, with an email when a new tool appears.
- Up to 50 people
- Two-step verification required for everyoneMembers without an authenticator app are asked to turn it on before they can open the workspace.
- Activity log, kept 3 years
- Priority support
- Single sign-on (SAML) and yearly bank transfer, on requestWrite to hello@privacyboard.io.
Bank transfer on request
Questions, answered.
Is a DPIA required for every activity?
No. It is required when processing is likely to result in a high risk for people. Screening each activity records why you decided one was or was not needed.
Do I need a TIA for a US provider?
Not when it is certified under the Data Privacy Framework and you rely on it. Under standard contractual clauses, yes. Privacyboard shows the official entry for common vendors, with the date we checked it.
Can I trust the suggested answers?
They are a starting point drawn from your own records and the vendors' published documents. Read each one against how the processing really works; the Suggested mark disappears once you change it.
What is free?
Screening every activity is free on every plan. Complete DPIAs and TIAs, with PDF export, are part of Pro and Business.
Does a completed DPIA make the processing compliant?
No. It records your assessment and the measures you chose. When the residual risk stays high, you must consult your authority before starting.