Data Protection Impact Assessment (DPIA) Checklist Template

The fourth task asks whether a DPIA is required. No shows only the screening record; Yes opens Phases 2 to 7.

• Register the project and name the DPO and the accountable approver — project owner, planned start of processing, and any joint controllers or processors
• Check the three cases in Article 35(3) — automated decisions with legal or similarly significant effects, large-scale special category or criminal offence data, large-scale monitoring of a public area
• Check the authority list for each country involved (Art. 35(4)) — each EU authority publishes one; the ICO’s list covers the UK
• Score the processing against the nine EDPB criteria and decide — two or more usually means a DPIA, one can be enough, and where it is unclear do one anyway
• Record why no DPIA is needed, with the DPO’s view — keep it on the project file and screen again if the scope changes

Article 35(7)(a). Shown only when the screening says a DPIA is required, as are Phases 3 to 7.

• Map how the data moves — collection, use, storage, sharing and deletion, with the systems and people involved; attach a data flow diagram
• Record the scope — data categories including special category data, number of people, volume, frequency, retention and geography
• Describe the context — what people would expect, children or vulnerable groups, novel technology, and any approved code of conduct (Art. 35(8))
• State the purposes and the benefits — for you, the people affected and society, including any legitimate interest relied on
• Get the facts from processors and vendors — hosting, sub-processors, transfers and security; Article 28(3)(f) obliges processors to help

Article 35(2), (7)(b) and (9).

• Ask the DPO for advice at the start — record the advice now, and at sign-off whether you followed it
• Seek the views of the people affected or their representatives — a survey, staff representatives or user research; document why if that is not appropriate
• Bring in security, engineering and legal input — on the measures, on what the system really does and on the lawful basis
• Confirm the lawful basis and test necessity — could less data, less identifiable data or a less intrusive method meet the same purpose
• Check minimisation, accuracy, retention, transparency and rights — plus processor contracts and safeguards for any transfer abroad

Article 35(7)(c). The risks are to the people whose data it is, not to the organisation.

• List the risks to individuals — unauthorised access, unwanted change or loss of data, and harms such as discrimination, financial loss or loss of control
• Rate each risk for likelihood and severity — on a scale agreed before scoring; harm can be physical, material or non-material
• Walk the data flow with the project team and the DPO — one step at a time, so risks at handovers and integrations are not missed
• Mark which risks are high — they drive the measures in Phase 5 and, if they stay high, the consultation in Phase 6

The residual risk answer decides whether Phase 6 appears. Both sign-offs are approvals assigned to the people named on the first task.

• Choose measures for each risk (Art. 35(7)(d)) — pseudonymisation, access controls, shorter retention, human review of automated decisions, an opt-out
• Record the residual risk after the measures — and whether it is still high; where a risk is accepted, record who accepted it and why
• DPO reviews the completed DPIA and gives advice — approval by the DPO, who also monitors how the DPIA is carried out (Art. 39(1)(c))
• Accountable approver signs off the outcome — with reasons for any DPO advice not followed; approval by the accountable approver

Shown only when the residual risk is still high. Due dates run from the date the request is submitted.

• Hold the processing until the authority has replied — Article 36(1) requires the consultation before processing starts
• Prepare the consultation pack (Art. 36(3)) — roles, purposes and means, measures and safeguards, DPO contact details and the DPIA
• Submit to the competent authority and record the date — your lead supervisory authority in the EU, the Information Commission in the UK
• Track the reply period — any extension must be notified within one month; the clock stops while the authority waits for information
• Act on the authority’s advice — redesign, add measures or stop; record the decision and update the DPIA

Article 35(11) asks for a review at least when the risk changes; the last task sets the triggers.

• Add every agreed measure to the project plan with an owner — and check each is in place before the processing starts
• Update the records of processing and the privacy notice — so Articles 30, 13 and 14 match what the DPIA approved
• Decide whether to publish a summary — not required, but WP248 calls it good practice where the public is affected
• Link the DPIA to a FRIA if a high-risk AI system is deployed — Article 27(4) of the AI Act lets the FRIA cross-refer instead of repeating it
• Set review triggers and file the signed DPIA (Art. 35(11)) — new data, a new purpose, a new vendor, new technology or a breach