Nine questions about a single processing operation: which data, how many people, what you do with it and in what context. You get a reasoned answer under Article 35 GDPR, the Romanian DPA's list in Decision no. 174/2018 and the nine criteria of the European guidelines, plus a DPIA skeleton following the 2026 EDPB template. Everything in your browser, nothing sent.
Enable JavaScript to use the questionnaire. Or write to us and we do the analysis together.
Three layers, in order of legal force. First the three cases in Article 35(3) GDPR and the seven types of processing on the Romanian DPA's list (Decision no. 174/2018), where the assessment is mandatory. Then the nine criteria of the WP248 rev.01 guidelines, where two criteria usually make the assessment necessary. Finally the exceptions and special situations: processing required by a law that already had an impact assessment (Article 35(10)), the processor role, high-risk AI systems (Article 26(9) AI Act), the national ID number and employee monitoring under Romanian Law no. 190/2018.
A four-level verdict (mandatory, probably required, analyse and document, does not seem necessary), the table of the nine criteria with the reason for each, the cases on the Romanian list that apply, remarks and exceptions, next steps and, where an assessment is needed, a DPIA skeleton following the EDPB template (sections 0–6), pre-filled with your answers: controller, name of the processing, reasons for the assessment, data categories, nature and context. The document can be printed, copied or downloaded as Word; if the result is “does not seem necessary”, the document is precisely the analysis the accountability principle requires at an inspection.
The legislation was checked on 22 October 2026. When it changes (for instance when the final EDPB template is published), we update the questionnaire and the verification date.
If the assessment is mandatory or probable, start with the skeleton in the document and with the DPO's advice; if you have no DPO, the DPO questionnaire tells you whether designation is mandatory. For the privacy notice of the same processing, use the privacy notice checker.
Article 35(3) GDPR gives three cases: systematic and extensive evaluation based on automated processing, including profiling, with decisions that produce legal or similarly significant effects; large-scale processing of special categories of data or criminal data; systematic monitoring of a publicly accessible area on a large scale. The Romanian DPA added four more types through Decision no. 174/2018: large-scale monitoring of vulnerable people, including employees and minors; new technologies used on a large scale; connected devices with sensors; traffic and location data processed systematically without the service requiring it. The list is not exhaustive.
The WP243 rev.01 guidelines give no numeric thresholds. Four factors are weighed: the number of data subjects, the volume and variety of data, the duration or permanence of the processing and its geographical extent. A single medical practice does not process on a large scale; a hospital, a chain of clinics or a bank does. The questionnaire combines the number of people with duration, volume and reach and says when the case is clear and when it is borderline.
On 10 March 2026 the European Data Protection Board adopted the first European DPIA template (version 1.0), published on 14 April and put to public consultation until 9 June 2026. It has seven sections, 0 to 6: overview of the processing, systematic description, analysis of the processing, necessity and proportionality, risk assessment and management, involvement of interested parties, conclusion and decision. Using it is not mandatory, but after the consultation the national authorities will adopt it as their single template or as a “meta-template” with which national templates must be compatible; until then the EDPB encourages its use. The questionnaire result includes a skeleton on this structure, pre-filled with your answers.
Carry it out now. The absence of an assessment is sanctioned separately (Article 83(4)(a)), and Article 35(11) requires a review at any change in the risk anyway. If the residual risk remains high after measures, consult the Romanian DPA before continuing (Article 36); the authority replies within eight weeks, extendable by six.
No. It is guidance generated automatically from the answers, under the law in force in October 2026, which you can print, copy or download as Word. The exact classification depends on details nine questions cannot verify; the analysis tells you which criteria are present, why, and what comes next.
We describe the processing, assess the risks with a suitable method, define the measures and prepare, if needed, the prior consultation with the Romanian DPA.