DPIA template (data protection impact assessment): when it is required and what to include
A data protection impact assessment (DPIA) is the analysis you carry out before starting a processing of personal data that is likely to result in a high risk to people: it describes the processing, checks that it is necessary and proportionate, assesses the risks to their rights and sets the measures that reduce them. The GDPR requires it in Article 35; Brazil's LGPD (Art. 38) and Chile's Law 21.719 (Art. 15 ter) have equivalent tools. If the risk is still high after the measures, you must consult the supervisory authority before you start (Art. 36). This guide is informational and is not legal advice.
When a DPIA is mandatory
Article 35(1) of the GDPR requires a DPIA when a processing, by its nature, scope, context or purposes, is likely to result in a high risk to the rights and freedoms of people, especially when it uses new technologies. Article 35(3) names three cases where it is always required:
- Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, with legal or similarly significant effects on people.
- Large-scale processing of special categories of data or of data on criminal convictions and offences.
- Large-scale systematic monitoring of a publicly accessible area.
Each supervisory authority also publishes a list of processing that always requires a DPIA in its country (Art. 35(4)), such as the lists of the ICO in the UK or the CNIL in France. Check your authority's list before deciding that you do not need one.
Screening: the 9 criteria of the European Data Protection Board
For cases that are not in the law or the list, the DPIA guidelines endorsed by the European Data Protection Board propose 9 criteria. As a working rule, a processing that meets two or more of them is likely to need a DPIA. Keep this screening in writing for every new or significantly changed processing, also when the answer is that no DPIA is needed:
| Criterion | Example |
|---|---|
| 1. Evaluation or scoring of people (profiling) | Credit risk score, behavioural segmentation |
| 2. Automated decision with legal or similar effects | Automatic rejection of a job application or a loan |
| 3. Systematic monitoring | Employee monitoring, CCTV of premises |
| 4. Sensitive or highly personal data | Health, biometrics, children's data, location |
| 5. Large-scale processing | Many people, high volume, long duration or wide area |
| 6. Matching or combining datasets | Joining data from two systems with different purposes |
| 7. Vulnerable data subjects | Children, patients, employees towards their employer |
| 8. New technology or innovative use | Facial recognition, AI systems, connected devices |
| 9. Prevents people from exercising a right or using a service | Automated screening to buy an insurance policy |
Example: an online shop that builds purchase profiles (criterion 1) of hundreds of thousands of customers (criterion 5) meets two criteria and should carry out a DPIA; the payroll of a small business usually does not.
ISO 27701 Toolkit: documentation for your privacy management system
38 Word documents · 15 Excel tools · 78 Annex A controls
See the ISO 27701 toolkit with DPIA procedure and ROPA templateWhat a DPIA must contain (Art. 35(7))
The law sets a minimum content. A useful template organises it in sections and leaves room for evidence:
| Section | What you write | Source |
|---|---|---|
| Description of the processing | Purpose, data, people affected, systems, vendors, data flow and, where relevant, the legitimate interest | Art. 35(7)(a) |
| Necessity and proportionality | Lawful basis, data minimisation, retention periods, information to people and how they exercise their rights | Art. 35(7)(b) |
| Risks to people | What could go wrong (unauthorised access, discrimination, loss of control over their data), likelihood and impact | Art. 35(7)(c) |
| Measures | Technical and organisational controls that reduce each risk, with owner and date | Art. 35(7)(d) |
| Residual risk and decision | Level after the measures, sign-off and, if still high, prior consultation with the authority | Art. 36 |
| Views of the DPO and of data subjects | Advice of the data protection officer and, where appropriate, the views of the people affected | Art. 35(2) and 35(9) |
A DPIA is not a one-off exercise: Article 35(11) asks you to review it when the risk changes, for example when you add data, a new vendor or an automated feature.
How to carry it out step by step
- Start from your record of processing activities: pick the processing and copy its purpose, data, recipients and retention.
- Run the screening with the 9 criteria and your authority's list; file it even if no DPIA is needed.
- Map the data flow: where the data comes from, where it is stored, who accesses it and where it goes.
- Assess each risk to people with the same likelihood and impact scale as your risk register.
- Define measures with owner and date, calculate the residual risk and get sign-off from the processing owner.
- Ask the data protection officer for advice and, if the residual risk is still high, prepare the prior consultation before the processing starts.
How it fits ISO 27701 and other laws
ISO/IEC 27701:2025 includes the privacy impact assessment among its controls for controllers (control A.1.2.6) and links it to the risk assessment of the management system (clause 6.1). That is why one method can serve several laws:
- GDPR and UK GDPR: DPIA required in the cases of Art. 35 and prior consultation under Art. 36.
- LGPD (Brazil): the ANPD may request the impact report (RIPD) of Art. 38, especially when the processing relies on legitimate interest.
- Law 21.719 (Chile): prior impact assessment for high-risk processing (Art. 15 ter); the agency will publish an indicative list. Check the current entry-into-force date before planning.
The NexoDocs ISO 27701 toolkit includes a DPIA procedure (PIMS-PRO-02) with the screening and the sections above, linked to the record of processing activities (PIMS-ROP-01) and the privacy risk register (PIMS-RSK-02), as editable Word and Excel files.
Common mistakes
- Doing the DPIA after the processing has started: the law asks for it before.
- Assessing only the risks to the company (fines, reputation) and not the risks to people, which are the core of a DPIA.
- Not keeping the screening in writing when you conclude that no DPIA is needed.
- Copying a generic DPIA without describing the real data flow and vendors.
- Not reviewing it when the processing changes or an AI tool is added.
Next step
Try it free or go straight to the complete solution.
ISO 27701 Toolkit: documentation for your privacy management system
38 Word documents · 15 Excel tools · 78 Annex A controls
See the ISO 27701 toolkit with DPIA procedure and ROPA template
Free sample
Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.
Get the free sampleFrequently asked questions
Is a DPIA mandatory for every company?
No. Under Article 35 of the GDPR it is only mandatory for processing that is likely to result in a high risk to people, such as the three cases in Art. 35(3) or those on your authority's list. For the rest, documenting the screening is enough.
What is the difference between a DPIA and a security risk assessment?
A security risk assessment (for example under ISO 27001) looks mainly at assets and the risk to the organisation. A DPIA looks at one specific processing and the risk to people's rights and freedoms, and includes necessity and proportionality.
Who should carry out the DPIA?
The controller, usually the process owner with support from the data protection officer, security and IT. A processor helps with information about its systems, but the obligation belongs to the controller.
Do I have to send it to the authority?
Not in general. Only if the risk is still high after the measures must you consult the authority before starting the processing (Art. 36). The DPIA is kept as evidence and handed over if the authority asks for it.
Does this guide replace a lawyer?
No. It is general information to organise the work and is not legal advice. For decisions on lawful bases or prior consultation, ask a professional in your country.
Related guides
Record of processing activities (GDPR Article 30): what to include and when to run a DPIA
What a record of processing activities (GDPR Article 30) must include, who must keep one, when a DPIA is needed and how it fits ISO 27701.
Read the guide →ISO 27701:2025 mandatory documents
Documented information ISO/IEC 27701:2025 requires: scope, policy, risk, Statement of Applicability, records and evidence, with the clause for each.
Read the guide →ISO 27701 vs GDPR: what is the difference?
ISO/IEC 27701 is a voluntary, certifiable standard; the GDPR is EU law. How they differ, where they overlap and how ISO 27701 organizes GDPR evidence.
Read the guide →Updated: 2026-10-28