DPIA and LIA software with AI guidance for your country
Start from templates based on the ICO’s, ask AI for country-specific answers, send any question to a colleague, and export a report you can put in front of a regulator.
Legitimate Interest Assessment
In progressSurveillance recordingsDoes the GDPR or national legislation specifically identify this processing as based on a legitimate interest?
Content generated by AI may contain inaccuracies. Please verify important information independently.
Guidance for the country you actually operate in
The GDPR is the same everywhere, but national laws and regulators are not. Ask AI drafts each answer for the country set in your organisation profile, using what your RoPA already says about the processing.
National rules, not just the GDPR
Answers reflect national legislation and regulator guidance, such as the ICO, the CNIL or the Irish DPC.
Grounded in your RoPA
Ask AI starts from the processing activity you are assessing, so drafts fit your purpose, data and vendors.
You decide what stays
Every draft lands in the editor for you to keep, rewrite or discard. Nothing is final until you say so.
Send the question to the person who knows
Privacy teams rarely know how long footage is kept or who can open it. Send that one question to IT, HR or a vendor, and keep the rest of the assessment moving.
- A task from any questionAssign it with a due date and a message, to a colleague or an external contact.
- Linked to the questionThe task opens the exact question, so the answer lands where it belongs.
- See what’s still openTrack who has replied and what is still waiting before you write the conclusion.
sent from questions in this assessment
Start from the ICO template then make it yours
The default DPIA and LIA question sets follow the ICO’s templates and its three-part legitimate interests test. Change the wording, hide what you don’t need, and add the questions your team always asks.
Assessment templates
Based on the ICO templatesDPIA risks go straight into your risk register
Record risks inside the assessment, or let AI suggest them. Each one is attached to the RoPA, marked as a DPIA risk and tracked from initial to residual rating.
What are the specific risks to individuals’ rights and freedoms?
Risks recorded here are attached to this RoPA and marked as DPIA risks. They appear in the risk register and in the DPIA report.
| Name | Entity | Initial risk | Treatment | Security measures | Residual risk |
|---|---|---|---|---|---|
| Data breach | ROPASurveillance recordings | High | Reduction | Advanced encryption, regular security audits, firewalls | Low |
| Unauthorized access | ROPASurveillance recordings | High | Reduction | Multi-factor authentication, role-based access | Low |
| Data loss | ROPASurveillance recordings | High | Reduction | Regular backups stored offsite, automated recovery | Low |
| Data corruption | ROPASurveillance recordings | Medium | Reduction | Integrity checks, regular updates and patches | Low |
A presentable report from everything you found
Generate a branded report from the finished assessment, with every answer, risk and conclusion laid out for management, auditors or a regulator.
Data Protection Impact Assessment
Surveillance recordings
Purpose
What is the purpose of the data processing?Protecting staff, visitors and premises from theft and violence.
Why is this purpose important to the organisation?- Safety: deters incidents and supports a response when they happen.
- Evidence: footage can help resolve incidents and claims.
- Organisation: fewer losses and faster investigations.
- Data subjects: a safer place to work and visit.
- Every question and answerGrouped by section, including your own custom questions.
- Risks and the conclusionInitial and residual ratings, measures, and the decision you reached.
- Your brand and a review dateYour logo and organisation on the cover, with who conducted it and when to review.
A DPIA isn’t a form to fill in. It’s how you show you thought it through, asked the right people and decided carefully.
Assessments live on the RoPA they assess
Started from the record
The RoPA shows when an LIA or DPIA is required, and its status once done.
Risk management
DPIA risks feed the risk register, with initial and residual ratings and treatment.
Explore risk managementQuestionnairesPrivacy impact assessments
Send customisable PIA questionnaires to anyone and write approved answers to the RoPA.
Explore PIAsQuestions we get asked
What is a DPIA?
A Data Protection Impact Assessment is required under Article 35 of the GDPR when processing is likely to result in a high risk to people’s rights and freedoms, for example systematic monitoring of a publicly accessible area on a large scale. It describes the processing, assesses its necessity and proportionality, identifies the risks and records the measures that address them.
What is a Legitimate Interest Assessment?
An LIA documents why you can rely on legitimate interests under Article 6(1)(f) of the GDPR. It follows a three-part test: the purpose test (is there a legitimate interest?), the necessity test (is the processing necessary for it?) and the balancing test (do people’s interests override it?).
When should you conduct a DPIA or an LIA?
Carry out a DPIA before starting processing that is likely to be high risk, such as large-scale monitoring, special category data or new technologies. Carry out an LIA whenever legitimate interests is your lawful basis. Some activities, such as workplace video surveillance, need both.
Are the templates based on ICO guidance?
Yes. The default DPIA and LIA question sets follow the UK Information Commissioner’s Office (ICO) templates and its three-part legitimate interests test. You can use them as they are or change them for your organisation.
Does Ask AI give country-specific guidance?
Yes. Ask AI uses the country set in your organisation profile, so there is nothing to choose. Its drafts take into account the GDPR together with that country’s national rules and regulator guidance, and the details already in your RoPA. You review, edit or discard every draft before it becomes part of the assessment.
Can we change the questions?
Yes. Every DPIA and LIA question can be edited, hidden or reordered, and you can add your own questions and sections, for example for internal policies, sector rules or works council consultation. The LIA and DPIA question sets are managed separately.
Can I assign a question to a colleague?
Yes. Create a task from any question to send it to a colleague or an external contact, with a due date and a message. The task stays linked to the question, so you can see what is still waiting.
What is included in the assessment report?
The report includes a branded cover page, every question and answer by section, the risks with their initial and residual ratings, the conclusion and the review date, ready for management, auditors or regulators.