The DPIA template #
Use one for each project. Start at section 1 and work down: sections 2 to 5 record the facts, 6 and 7 are where the thinking is, and 8 is the decision. The ICO says there is no template you have to use, so change the headings if your organisation already has a format, as long as the same content is there.
Click anything in brackets to type over it, then copy, print or download the result. Nothing you type leaves this page.
Data protection impact assessment
1. The project
| Project or process | [What is being introduced or changed] |
|---|---|
| Controller | [Organisation name] |
| Project owner | [Name and role] |
| Data protection officer | [Name, or "none appointed"] |
| Date started and version | [Date, version 1] |
2. Why an assessment is needed
Tick or delete what applies. The first three are the cases Article 35(3) lists.
- [ ] Systematic evaluation of people based on automated processing, with legal or similarly significant effects
- [ ] Large scale processing of special category data
- [ ] Systematic monitoring of a publicly accessible area on a large scale
- [ ] Another reason the processing is likely to be high risk to individuals: [Say what]
- [ ] Not required, and this is a shorter assessment done as good practice
3. Description of the processing
| Nature: what will happen to the data | [Collected how, used how, stored where, who sees it] |
|---|---|
| Purposes: why | [What you are trying to achieve, and the benefit to you and to the individuals] |
| Scope: whose data and which data | [Types of individual, categories of data, any special category data, how many people] |
| Context: what people would expect | [Your relationship with them, whether they would expect this use, anything novel or sensitive] |
| Recipients and suppliers | [Who else receives the data, including any processor] |
| Retention | [How long the data is kept, and how it is deleted] |
4. Consultation
| Who has been asked | [Individuals or their representatives, staff, the DPO, security, suppliers] |
|---|---|
| What they said | [Summary of the views, and what changed as a result] |
| If no one was asked | [Why not] |
5. Necessity and proportionality
| Lawful basis | [The basis, and why it applies] |
|---|---|
| Does it achieve the purpose? | [Yes or no, and the reason] |
| Is there a less intrusive way? | [Alternatives considered, and why this one] |
| Data minimisation | [Why each item of data is needed, and what you chose not to collect] |
| Telling people | [How individuals are informed, and where their rights can be exercised] |
| Processors and transfers | [Contract in place, and any transfer outside the UK] |
6. Risks to individuals
Think about harm to the people the data is about, not risk to the organisation. Score likelihood and severity as low, medium or high.
| No. | Source of risk and the harm to individuals | Likelihood | Severity | Overall |
|---|---|---|---|---|
| 1 | ||||
| 2 | ||||
| 3 | ||||
| 4 | ||||
| 5 |
7. Measures to reduce the risks
| Risk no. | Measure, safeguard or security control | Effect on the risk | Risk left | Approved? |
|---|---|---|---|---|
Effect on the risk: eliminated, reduced or accepted. Risk left: low, medium or high.
8. Sign-off and outcome
| Measures approved by | [Name, role and date] |
|---|---|
| Residual risks approved by | [Name, role and date] |
| DPO advice | [Whether the processing is compliant and can go ahead] |
| If the advice was not followed | [The reasons] |
| High risk remains? | [Yes or no. If yes, the ICO must be consulted before the processing starts] |
| Outcomes put into the project plan by | [Name and date] |
| Review date | [Date, or the event that triggers a review] |
What a DPIA is, in the order you do it #
-
Identify the need
Is the processing likely to be high risk to individuals? Section 2.
-
Describe the processing
Its nature, scope, context and purposes. Section 3.
-
Consider consultation
Seek the views of the people affected and of the others involved. Section 4.
-
Assess necessity and proportionality
Does it achieve the purpose, and is there a less intrusive way? Section 5.
-
Identify and assess the risks
The harm to individuals, by likelihood and severity. Section 6.
-
Identify measures to reduce them
What you will do about each one, and what is left. Section 7.
-
Conclude and sign off
Record the outcome and get approval before the processing starts. Section 8.
What Article 35(7) requires it to contain #
The Article names four things that a DPIA has to include at a minimum: a systematic description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to the rights and freedoms of individuals, and the measures planned to address those risks. In the template those are sections 3, 5, 6 and 7. Sections 1, 2, 4 and 8 are what make it a record somebody can sign and review.
A short version for a small project #
Not every project meets the threshold. The guide on whether an automation project needs a DPIA says when it does and does not, and why a short version is still worth doing when it is not required. For those, sections 3, 5 and 6 on one page, signed by whoever owns the project, are usually enough. The template has a tick box for that case.
The DPIA sits beside the contract with any supplier that handles the data: see what a data processing agreement must contain. If your organisation also has a rule for staff use of AI tools, the AI policy generator drafts one.
What the office does with it by hand #
In most organisations the DPIA is a document somebody starts, emails round for comments, updates in three versions and then files where nobody finds it. The steps that follow a rule are the chasing for comments, the reminder when the review date arrives, the check that a new supplier has a contract and the filing. The judgement is in the risk scoring and in the decision to go ahead, which is a person's.
The task sorter separates the two kinds of work. The admin time calculator shows what the first kind costs in a month.