A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Describe a processing activity and we assemble a structured DPIA / PIA draft you can copy into your own document. It follows the shape expected under GDPR Article 35 and Quebec Law 25. It is a starting draft, not a filed assessment.
Fill in the activity name and purpose to generate your draft.
Under GDPR Article 35, a Data Protection Impact Assessment is required for processing that is likely to result in a high risk to individuals, such as large-scale profiling, systematic monitoring, or processing of sensitive data. Quebec Law 25 requires a Privacy Impact Assessment for high-risk projects and certain cross-border transfers.
No. It is a structured first draft based on what you enter. You must review it, add real detail about your controls and risks, and have it validated by a privacy professional before you rely on it.
They are the same idea under different names. GDPR calls it a Data Protection Impact Assessment (DPIA); Quebec Law 25 and many other frameworks call it a Privacy Impact Assessment (PIA). Both document the risks of a processing activity and how you mitigate them.
Yes, it is free with no signup. If you need DPIAs done properly and defensibly, our privacy and GDPR readiness services can help.
Not ready for a call yet?
A few short notes from Jacob on DPIAs, lawful bases, and getting GDPR-ready without the legalese. No fluff, unsubscribe in one click. Reply anytime; it reaches him directly.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Want it done for you?
GDPR Readiness
We run your DPIAs and get your data processing GDPR-compliant.
Explore GDPR Readiness →We run DPIAs and privacy impact assessments that hold up, map your data flows, and get your processing GDPR and Law 25 ready.
See GDPR Readiness Book a callThis gives you the shape of the problem. The full picture is all 60 obligations of GDPR, each one explained in plain English, with somewhere to attach the evidence and a readiness score that moves as you close gaps. Start a free assessment and walk every control.
No credit card, no trial clock, no locked features. TrazTech makes money when someone wants help closing the gaps, not from the Workspace itself.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.