Privacy & AI Governance Self-Assessment

Ten practitioner-built assessments, modeled on the kind of tools used in real privacy, AI governance and third-party risk programs. The Privacy Assessment screens a process end to end - what data, whose, for what purposes, on what lawful basis, with what retention, who it is shared with and where it goes - and tells you whether a DPIA is needed; if it is, it hands over to the Full DPIA - necessity and proportionality, individual rights, transfers, the harms the processing could cause individuals rated before and after mitigation, and the three feared security events, all plotted on one severity × likelihood matrix. Where a process relies on legitimate interests, the Legitimate Interest Test works through the purpose, necessity and balancing tests and shows both sides of the balance. The AI Risk Assessment classifies an AI system against the EU AI Act, and the Incident & Breach Severity Assessment records an incident and calculates its severity score using the published ENISA method, with an analysis of what drives the score and what would change it. The Third-Party Security Assessment is a detailed vendor security questionnaire - governance, people, assets, development, access, operations, cryptography, incident response, physical security, continuity, compliance, and an AI/ML supplement - scored as inherent risk tempered by control maturity, with a full list of gaps to close. Three more cover newer obligations: the Fundamental Rights Impact Assessment for deployers of high-risk AI under Article 27 of the EU AI Act, which can start from a DPIA saved on your device; the Generative AI Risk Assessment, which maps its gaps to the NIST Generative AI Profile and the OWASP Top 10 for LLM Applications; and the Transfer Impact Assessment, which follows the six steps of EDPB Recommendations 01/2020. The AI Assessment Pathway runs the AI tools as one: a shared intake asked once, an impact level from I to IV that sets how deep the rest goes, generative AI and EU AI Act modules that open only when they apply, and one risk register mapped to the NIST AI RMF, NIST AI 600-1, ISO/IEC 42001 and the Singapore framework for generative AI, with handovers to the DPIA and the FRIA. Everything runs in your browser - nothing is submitted anywhere, and your saved assessments stay on your own device, exportable as JSON or CSV. Looking for the underlying guidance rather than a scored assessment? Jump to Practical Privacy for an everyday playbook of genericized, practitioner-tested guidance, or Practical AI Act Advice for a working reference on EU AI Act scope, obligations and enforcement.