## 3 Results  
The text snippets within the DIPA click&go tool were carefully developed for our institute by incorporating the knowledge of legal experts, IT specialists, clinical project partners, as well as existing DPIAs. This enabled us to create a tool for our institute in which different use cases (e.g., multicentric registers, biomaterial usage, data warehouses, and tumor boards) are included. An exemplary snippet of the DPIA click&go tool to illustrate its function is shown in Figure 4. The complete description of the mockup can be found in the Supplementary File S1. It is important to acknowledge that neither the comprehensive publication of the DPIAs for the projects nor the publication of the utilized DPIA click&go text snippets is feasible due to internal data protection constraints within the hospital setting. Figure 4: Screenshots of the mockup version to showcase some crucial parts (simplified) of the DPIA click&go tool (original version in German). (**A**) First, one can select the type of DPIA, i.e., which components are involved. (**B**) Then, the corresponding general risk sources and their risk score are suggested. (**C**) Afterward, an overview of the potential harm events related to the selected risk source is depicted. (**D**) TOM(s) that aim to mitigate the probability of occurrence and /or severity of harm for the selected harm event are suggested, thereby enhancing data protection strategies. Note that the content of the text snippets can be changed, new TOMs and risks can be added, and all scores can be adjusted. After the described selection process from (**A**) to (**D**), there is a button that generates the customized DPIA as a Word document. The complete description of the tool can be found in the Supplementary File S1. The backend of the DPIA click&go tool is coded in Java (OpenJDK Amazon Corretto [25]), whereas the frontend is built in React [26]. The utilized database is PostgreSQL [27]. The selection of Java, React, and PostgreSQL for the backend, frontend, and database technologies, respectively, was driven by their established status in the industry. Java 17 serves as our code standard, while React with TypeScript was chosen to simplify implementation, enhance flexibility, and ensure compatibility with web browsers used in the clinical environment, particularly in the context of corporate policy restrictions. Finally, PostgreSQL was the preferred database choice due to our extensive experience and consistently positive outcomes with the platform. The code of the \"raw\" DPIA click&go tool will be publicly available here: [[https://github.com/LTRiemann/DPIA_click_and_go.git](https://github.com/[PERSON]/DPIA_click_and_go.git)]([https://github.com/[PERSON]/DPIA_click_and_go.git](https://github.com/[PERSON]/DPIA_click_and_go.git)) (accessed on 4 October 2023). Note, that the non-tailored, publicly available version of the tool only includes risks and TOMs that are suggested by the German Federal Office for Information Security (in German: _Bundesamt fur Sicherheit in der Informationstechnik--BSI_). Each institute has to adapt and fundamentally extend them to their specific requirements and circumstances by using already existing DPIAs. The included risks and TOMs serve solely the purpose of facilitated understanding. Each existing DPIA can be included in the tool in the form of an Excel spreadsheet or directly by using a PostgreSQL database. The corresponding data model and example Excel spreadsheet can be also found on GitHub. Due to the search function within the tool and the possibility of seeing the complete list of TOMs and risks, the curation of the text snippets is facilitated. In the context of the chosen exemplary tumor board project, a comparative analysis between the DPIA generated using the DPIA click&go tool and the manually crafted DPIA, developed by a cohort of researchers and IT specialists lacking legal expertise, revealed the discovery of 11 additional risks and 14 corresponding TOMs.