Data Protection Impact Assessment (DPIA)

ISO/IEC 27701 + GDPR Art.35 required for high-risk processing. Required when: systematic profiling, large-scale sensitive data, public-area monitoring, new tech, or processing could restrict data subject rights.

Field	Value
Assessment ID	DPIA-YYYY-NNN
Processing activity	name
Assessor	@name
DPO consulted	@name – required for high-risk
Date	YYYY-MM-DD
Status	Assessment / mitigation / approved

1. Processing description

• What: personal data types, subjects (customers/employees/users)
• Purpose: why processing happens
• Scale: volume, duration, geographic scope
• Tech: systems, storage, transfers
• Data flow: collection → use → storage → sharing → deletion

2. Necessity & proportionality

• Is the processing necessary for the purpose?
• Is there a less invasive alternative?
• Lawful basis: consent / contract / legal obligation / legitimate interest

3. Risk assessment to data subjects

Risk to individuals	Likelihood	Severity	Existing controls	Residual
Unauthorized disclosure	H/M/L	H/M/L	encryption, access
Re-identification of anonymized
Discrimination/profiling harm
Loss of availability

4. Consultation

• DPO opinion: summary of advice given
• Data subject input: how views were considered (if required)

5. Mitigation plan

Risk	Measure	Owner	Residual target	Due
High residual risk	additional control	@name	acceptable

6. Outcome

• Processing may proceed (residual acceptable)
• Proceed with mitigations above
• Requires prior consultation with supervisory authority
• Must not proceed

7. Approvals

Role	Name	Decision	Date
DPO		approved/conditions
Data controller