Privacy and data protection support
DPIA and PIA drafting
A DPIA is a structured argument, not a form. We draft the whole assessment — the processing described accurately, necessity and proportionality argued, risks assessed with mitigations and residual risk stated — for your review and sign-off.
- Published price
- $800–3,000 / assessment
- Turnaround
- 5 business days
- Without us
- $5,000–20,000
Fixed per unit, not hourly. No minimum engagement. Quoted before we start.
What you receive
A completed data protection impact assessment identifying risks and the mitigations adopted.
- A complete assessment in the structure the relevant regulator expects
- The processing described accurately, including data flows and the parties involved
- Necessity and proportionality assessed against the stated purpose, with alternatives considered
- A risk register scoring likelihood and severity from the data subject's perspective
- Mitigations mapped to each identified risk, with owners and implementation status
- A residual risk statement and a consultation recommendation where thresholds are met
What it costs, and what it replaces
Both figures are published ranges for the same unit of work. Ours is fixed before we start; if our process gets faster, that is our gain and your price does not move.
How engagements are structured →- Adnah Legal
- $800–3,000 / assessment
- Typical cost without us
- $5,000–20,000 / assessment
Roughly 85% lower at the midpoint of each published range.
How the work runs
01
Describe the processing accurately
Most weak assessments fail here: the processing described is the one on the slide deck rather than the one being built. We work from technical documentation and reconcile it against the project description.
02
Necessity and proportionality
We assess against the stated purpose and document the less intrusive alternatives that were considered and why they were rejected, which is the part regulators look for first.
03
Risk from the subject's perspective
Risks are scored from the data subject's point of view rather than the organisation's, since an assessment that only measures organisational risk is a security review wearing the wrong title.
04
Mitigations and residual risk
Each risk is mapped to a mitigation with an owner and a status, and residual risk is stated plainly, including whether consultation thresholds are met.
What we need from you
- A description of the processing, system or project being assessed
- Technical documentation and data flow information
- Existing security and organisational measures
- The record of processing entry, if one exists
What we check before delivery
- The processing description is reconciled against technical documentation, not just the project brief
- Every identified risk has at least one mapped mitigation or an explicit acceptance
- Residual risk statements are checked against the mitigations actually implemented, not planned
- Consultation thresholds are checked against the current regulator guidance
When firms send us this
- New systems processing sensitive data or operating at scale
- AI deployments triggering assessment obligations
- Regulator engagement where an existing assessment has been criticised
- Vendor onboarding requiring an assessment before go-live
Questions about dpia and pia drafting
Can you assess an AI system?
Yes, and it is increasingly the main reason firms send these. Where an AI-specific impact assessment is also required, we can prepare both so they are consistent with each other.
Do you sign off the assessment?
No. Sign-off sits with the controller and the DPO. We draft it to be signed off, and flag where the evidence does not support the conclusion being sought.
What if the mitigations are not implemented yet?
Then the residual risk statement says so. An assessment that credits planned mitigations as if they existed is the kind that becomes evidence against the organisation later.
Firms who send us this usually also send
More in Privacy and data protection support
All privacy and data protection support services →This service
Send one and judge the output.
DPIA and PIA drafting at $800–3,000 per assessment, 5 business days. No minimum, no scoping call, no onboarding cycle.