Voyage Digital
    Skills· Legal & Compliance

    The DPIA Draft

    The DPIA Draft turns a description of a processing activity into a structured Data Protection Impact Assessment draft under Article 35 GDPR, complete with a risk analysis, a measures plan, and a recommendation for your data protection officer.

    structuringanalytical

    Description

    The DPIA Draft produces the structured draft of a Data Protection Impact Assessment under Article 35 GDPR: description of the processing, necessity and proportionality assessment, risk analysis, plan of measures, and recommendation in a single pass. The skill is built for controllers facing a processing activity that is likely to result in high risk, for example the everyday use of AI systems (ChatGPT and comparable tools), profiling, or scoring, who want to hand their data protection officer a solid working basis instead of a blank page.

    The skill works from an implementation perspective, not as an expert opinion: it structures what belongs in a DPIA, consistently separates mandatory measures from recommendations, and explicitly flags missing facts as assumptions instead of silently filling them in. It replaces neither the substantive review by the data protection officer nor a legal assessment.

    Deliberate boundary: the tool makes no legally binding statement on the lawfulness of a processing activity and does not conclusively assess any individual case. It delivers the draft; approval remains with the data protection officer.

    Note: this tool does not replace legal advice. Have any results with legal implications reviewed by a lawyer before you act on them.

    Example scenario

    A company is planning to introduce an AI-supported applicant management system. The skill produces the DPIA from this: a description of the processing covering data categories, data subjects, and systems in use, six identified risks ranging from discrimination to data leaks with an assessment matrix, existing and recommended protective measures, a residual risk assessment at the medium level, and the recommendation to consult the data protection officer.

    Steps

    Every step shows who carries it out: icon, colour and label together indicate whether a person acts, whether it runs automatically, whether a result is produced, or whether an approval is required.

    01Person

    The data processing, categories of data affected, purpose, and technical systems in use are provided.

    02Automated

    03Automated

    04Automated

    05Result

    Key
    PersonAutomatedResultApproval

    In use

    Processing activity

    Required

    Categories of data and data subjects affected

    Required

    Purpose of the processing

    Required

    Technical systems and service providers

    Required

    Existing protective measures

    Optional

    Legal basis

    Optional

    Output

    A complete DPIA draft with a description of the processing, necessity and proportionality assessment, risk identification and assessment, existing and recommended measures, a residual risk assessment, and a clear recommendation of approval, adjustment, or consultation with the supervisory authority.

    Skill Text

    Copy the prompt below in full into your AI tool. As a file: dsfa-expose.en.json

    # DESCRIPTION
Produces the structured draft of a Data Protection Impact Assessment (DPIA) under Article 35 GDPR. Analyzes risks to the rights of data subjects and derives appropriate protective measures from them. Address the user in a professional manner throughout.

# INPUT
- Processing activity: what is being processed, including the use of AI systems such as ChatGPT, Copilot, or comparable tools, where these play a role in the processing
- Categories of data and data subjects affected
- Purpose of the processing
- Technical systems and service providers
- Optional: existing protective measures, legal basis

# OUTPUT
Complete DPIA draft:
1. Description of the processing: nature, scope, context, purpose
2. Necessity and proportionality: assessment under Article 35
3. Risk identification: potential risks to data subjects
4. Risk assessment: likelihood times severity
5. Existing measures: technical and organizational measures (TOMs) already in place
6. Additional measures: recommended protective measures, clearly separated from mandatory measures and optional recommendations
7. Residual risk assessment: risk remaining after the measures are implemented
8. Recommendation: approval, adjustment, or consultation with the supervisory authority

# CONTEXT
- This DPIA does not replace a legal review by the data protection officer (DPO) or legal advice. It provides the professional draft as a starting point.
- The risk assessment is carried out consistently from the perspective of the data subjects, not the company.
- TOMs are the core of every risk mitigation effort.
- Particularly relevant for profiling, video surveillance, scoring, and the use of AI, including everyday use of AI tools such as ChatGPT, where personal data is processed.
- Where facts about the processing are missing, the assistant explicitly flags its assumptions as an assumption and asks for clarification where needed, instead of silently filling them in.

# WORKING INSTRUCTIONS
## Step 1: Describe the processing activity
Systematically document the nature, scope, context, and purpose of the data processing.

## Step 2: Assess necessity and proportionality
Evaluate the legal basis and proportionality of the processing.

## Step 3: Identify and assess risks
Identify potential risks to the rights of data subjects and assess them by likelihood times severity.

## Step 4: Document protective measures
Record existing TOMs and recommend additional protective measures, clearly marked as mandatory or recommended.

## Step 5: Assess residual risk and formulate a recommendation
Assess the risk remaining after the measures are implemented and give a clear recommendation (approval, adjustment, or consultation).

# QUALITY CONTROL
[ ] Processing fully described
[ ] All relevant risks identified and assessed
[ ] Measures concrete, appropriate, and separated into mandatory and recommended
[ ] Residual risk assessment documented
[ ] Clear recommendation formulated
[ ] Note on the boundary to legal advice and the review by the DPO included
[ ] Missing facts flagged as assumptions

# CONVERSATION START
Which processing activity do you need a DPIA for? Describe the data processing, the categories of data affected, and the purpose. I will use this to create a structured impact assessment for you. Note: this draft does not replace a review by your data protection officer.

    Setup

    Step-by-step guides for ChatGPT, Claude, Copilot Studio and Langdock.

    ChatGPT

    OpenAI

    1. Copy the skill text above using the copy button.
    2. Click your profile picture and select "Skills".
    3. Click "Create skill" and paste the copied text as the instruction.
    4. Adjust inputs, outputs and format where your case requires it.
    5. Save the skill. It is available in all chats from that point on.
    Documentation

    Anthropic

    1. Copy the skill text above using the copy button.
    2. Open claude.ai and go to "Skills" in your profile.
    3. Create a new skill and paste the copied text as the instruction.
    4. The skill works in claude.ai, in Claude Code and through the API.
    5. Available on the Pro, Max, Team and Enterprise plans.
    Documentation

    Microsoft

    1. Copy the skill text above using the copy button.
    2. Open Copilot Studio and create a new agent.
    3. Paste the copied text as the instruction.
    4. Connect knowledge sources and tools where needed.
    5. Publish the agent for yourself or for your organisation.
    Documentation

    1. Copy the skill text above using the copy button.
    2. Open the sidebar and click "Add skill".
    3. Paste the copied text directly as the instruction.
    4. Connect the skill to integrations such as Gmail or Slack where needed.
    5. Save the skill and release it for yourself or your team.
    Documentation

    Implementation

    1. Copy the skill text

      The skill text is pasted into the AI tool of choice, and the processing activity is described as specifically as possible.

    2. Add existing measures

      Technical and organizational measures already in place are added, which makes the assessment more realistic.

    3. Have the result reviewed

      The draft is submitted to the data protection officer for review before the processing is approved.

    Last reviewed:

    In the workshop this becomes your method.

    A single prompt becomes a repeatable method. We show that in the workshop From Prompt to Method.

    View workshops

    Related resources

    Browse all resources
    Assistants

    The Contract Screener

    The Contract Screener reviews a contract before signing, ranks its key clauses by risk, and gives executives a structured basis for the decision and the negotiation.

    Learn more
    Skills

    The Compliance Rulebook

    The Compliance Rulebook turns regulatory requirements into a structured, plain-language compliance policy complete with rules, responsibilities and reporting channels, ready for legal review before it takes effect.

    Learn more
    Workflows

    The Contract Risk Chain

    An automation workflow that reads new contracts on arrival, extracts key terms, and files a structured high, medium and low risk assessment for the responsible team to review.

    Learn more
    Assistants

    The Data Protection Reviewer

    Checks vendor and AI tool data protection documents against GDPR, rates risks with a traffic light system, and delivers concrete renegotiation points.

    Learn more
    Assistants

    The EU AI Act Navigator

    Classifies AI use cases under the EU AI Act into the appropriate risk category and shows small and mid-sized companies the obligations and next steps that follow, while clearly separating settled law from interpretation.

    Learn more
    Assistants

    The Contract Risk Reviewer

    Reviews contract texts before signing, flags the five most critical risks, and gives a concrete recommended action for each.

    Learn more
    Skills

    The Client Meeting Protocol

    Turns notes or a transcript from a client meeting into a structured protocol with a BANT or MEDDIC opportunity analysis, action items, and a follow-up email draft.

    Learn more
    Skills

    The Pipeline Protocol

    Systematically checks your CRM pipeline, flags deals that need action, and delivers a compact report with metrics and prioritized next steps.

    Learn more
    Assistants

    The Call Analyst

    Turns call notes or a sales call transcript into a CRM-ready follow-up document with needs analysis, BANT assessment and a scheduled follow-up plan.

    Learn more
    claude-video
    Tools

    claude-video

    claude-video is a video analysis pipeline that downloads videos, extracts frames, and produces transcripts so Claude can answer targeted questions about individual scenes.

    Learn more

    Conversation, not pitch

    Understand first, then decide. We take time for an initial conversation, without sales pressure, without obligation.

    Schedule a call