Tools

Record per organisation under Art. 30(1) or (2): purposes, legal bases, data subjects, data categories, recipients, third countries, erasure periods, TOMs. Completeness check per letter, results from the DPIA screening and the transfer check, print version for the authority.

• Art. 30 DSGVO Open in the law texts
• Art. 5 Abs. 2 DSGVO Open in the law texts

Full DPIA under Art. 35(7): description, necessity, five risk sources before and after measures in a risk matrix, DPO advice, sign-off or prior consultation under Art. 36 with the deadline for the opinion. Print version as report.

• Art. 35 DSGVO Open in the law texts
• Art. 36 DSGVO Open in the law texts

Is a data protection impact assessment required? Checks the Art. 35(3) examples, the DSK must-list and the nine WP 248 criteria.

• Art. 35 Abs. 3 DSGVO Open in the law texts
• Art. 35 Abs. 4 DSGVO Open in the law texts
• WP29 WP 248 rev. 01

Does Art. 6(1)(f) GDPR hold? Three-step test under EDPB Guidelines 1/2024: legitimate interest, necessity and a weighted balancing of children, Art. 9 data, expectations and safeguards.

• Art. 6 Abs. 1 lit. f DSGVO Open in the law texts
• EDPB Leitlinien 1/2024

Does the website need consent under § 25 TDDDG, and is the banner valid? Blocking before consent, reject on the first layer, no pre-ticked boxes, information, withdrawal, proof and third-country transfers. Every defect with a remedy.

• § 25 TDDDG Open in the law texts
• Art. 7 DSGVO Open in the law texts

Is the transfer outside the EEA lawful? Checked in the order of Chapter V: adequacy decision and Data Privacy Framework, standard contractual clauses or BCRs with transfer impact assessment and supplementary measures, Art. 49 derogations.

• Art. 44–49 DSGVO Open in the law texts
• EuGH C-311/18 (Schrems II)

72-hour clock from awareness, risk assessment (notify the authority? inform data subjects?), Art. 33(3) contents, status from recording to closure and documentation under Art. 33(5).

• Art. 33 DSGVO Open in the law texts
• Art. 34 DSGVO Open in the law texts

Track requests under Art. 15 to 22: one-month period from receipt with a two-month extension, identity check, checklist per right, refusal with reasons and a register of all requests.

• Art. 12 DSGVO Open in the law texts
• Art. 15–22 DSGVO Open in the law texts

Register of processors with a checklist for Art. 28(3) first sentence and points (a) to (h), sub-processors, evidence of sufficient guarantees and review dates.

• Art. 28 DSGVO Open in the law texts
• EDPB Leitlinien 07/2020

Measures per system along the seven protection goals of the Standard Data Protection Model, with protection requirement, a check against Art. 32(1)(a) to (d) and review dates for effectiveness reviews.

• Art. 32 DSGVO Open in the law texts
• DSK Standard-Datenschutzmodell

Retention periods per data type with their legal basis (HGB, AO, EStG, AGG), start of the period, erasure rule and erasure runs as deadlines; checks periods that are too short or too long.

• Art. 5 Abs. 1 lit. e DSGVO Open in the law texts
• Art. 17 DSGVO Open in the law texts
• § 35 BDSG Open in the law texts

Data protection training with topics, target group, attendance and evidence; the repetition appears as a deadline.

• Art. 39 Abs. 1 lit. b DSGVO Open in the law texts
• Art. 32 Abs. 4 DSGVO Open in the law texts

Which AI Act risk class does an AI system fall into? Decision tree from Art. 5 through Annexes I and III and the Art. 6(3) exception to Art. 50, with obligations and the application date after Omnibus Regulation 2026/1744.

• Art. 5 KI-VO Open in the law texts
• Art. 6 KI-VO Open in the law texts
• Anhang III KI-VO Open in the law texts
• Art. 50 KI-VO Open in the law texts
• Art. 113 KI-VO Open in the law texts

Which notices does Art. 50 AI Act require? Chatbot notice and marking of synthetic content for providers, disclosure of emotion recognition, deepfakes and AI-generated text for deployers, with the exceptions and dates.

• Art. 50 Abs. 1–5 KI-VO Open in the law texts
• Verordnung (EU) 2026/1744 KI-VO

Checklist for deployers of high-risk AI systems: instructions for use, human oversight, input data, monitoring, logs, informing staff and affected persons, DPIA, fundamental rights impact assessment. Every gap with a remedy.

• Art. 26 KI-VO Open in the law texts
• Art. 4, 27, 86 KI-VO Open in the law texts

What does the GDPR require when an AI system processes personal data? Legal basis per phase, Art. 9 data, automated decisions, minimisation, accuracy, transparency, data subject rights, DPIA, processors and third-country transfers.

• Art. 5, 6, 22, 35 DSGVO Open in the law texts
• EDPB Stellungnahme 28/2024

Is the technical documentation of a high-risk AI system complete? The nine sections of Annex IV, ongoing updates and ten-year retention, with a remedy for every missing part and a pointer to the simplified form for SMEs.

• Art. 11 KI-VO Open in the law texts
• Anhang IV KI-VO Open in the law texts

Draft internal policy for generative AI from twelve decisions: approved tools, private accounts, personal and confidential data, review, labelling, code, decisions about persons, training, responsibility, incidents, works council. Risky choices are flagged.

• Art. 4 KI-VO Open in the law texts
• Art. 5, 22, 28 DSGVO Open in the law texts
• § 87 Abs. 1 Nr. 6 BetrVG

Gap analysis against ISO/IEC 42001: context, leadership, planning, the control areas of Annex A and improvement; each gap linked to the AI Act obligations.

• Kap. 4–10 ISO 42001
• Anhang A ISO 42001

Inventory of AI systems: purpose, role (provider/deployer), model, data categories, risk class backed by the risk classification, owner and review date. With an obligations overview, history, CSV export and print version.

• Art. 3 KI-VO Open in the law texts
• Art. 6 KI-VO Open in the law texts
• Art. 26 KI-VO Open in the law texts

AI literacy measures per role: systems used, prior knowledge, context of use, content, evidence and refreshers as deadlines; stricter check for human oversight under Art. 26(2).

• Art. 4 KI-VO Open in the law texts
• Art. 26 Abs. 2 KI-VO Open in the law texts

Serious incidents with high-risk AI systems: classification under Art. 3(49), reporting period of 15, 10 or 2 days from awareness, deployers informing the provider, investigation and a pointer to a parallel data breach.

• Art. 73 KI-VO Open in the law texts
• Art. 26 Abs. 5 KI-VO Open in the law texts

Assessment under Art. 27 for public bodies, private entities providing public services and credit or insurance deployers: applicability, elements (a) to (f), rights concerned, reference to the DPIA, notification of the market surveillance authority and first use as a deadline.

• Art. 27 KI-VO Open in the law texts
• Anhang III Nr. 5 KI-VO Open in the law texts

Plan and track audits: subject, criteria (GDPR, BDSG, AI Act, ISO 27001, ISO 42001, TISAX), independent auditors, methods and dates; checklists, findings and the report link to the audit.

• Kap. 9.2 ISO 27001
• Kap. 9.2 ISO 42001

Topics per audit with question sets for GDPR, TOMs, data subject rights, processing on behalf, breaches, AI Act, ISMS and AIMS, plus samples, interview notes, evidence and result.

• Kap. 9.2 ISO 27001
• Art. 39 Abs. 1 lit. b DSGVO Open in the law texts

Major and minor nonconformities, opportunities for improvement and positive findings with evidence, root cause, corrective action, deadline and effectiveness check.

• Kap. 10.2 ISO 27001
• Kap. 10.2 ISO 42001

Report per audit with summary, overall conclusion, strengths and recommendations; audit, checklists and findings are appended and printed with it.

• Kap. 9.2.2 ISO 27001
• Kap. 9.2 ISO 42001

Check source code in the browser for secrets, personal-data patterns, calls to external AI services and trackers; findings list with masked excerpts for the DPO, exportable as CSV. Nothing is uploaded.

• Art. 25 DSGVO Open in the law texts
• Art. 32 DSGVO Open in the law texts

Test prompt sets for injection, data leakage, discrimination and misuse plus control questions against a chatbot, by pasting answers or directly against an OpenAI-compatible endpoint; refusal, leak and over-refusal rates as risk-management evidence.

• Art. 9 KI-VO Open in the law texts
• Art. 15 KI-VO Open in the law texts