COMPLIANCE

Data Protection Impact Assessment (DPIA)

Full DPIA under GDPR Article 35 for high-risk processing. Covers scoping, risk assessment, mitigation, DPO consultation, and (if needed) prior consultation with the supervisory authority.

Tasks
22
Span
30d
Use this template in Dorift Download for Android Download as JSON

Tasks in this template

  1. 1
    Confirm that a DPIA is required D+1

    Article 35(1) & (3): required where processing is likely to result in a high risk, and always for the cases listed (systematic evaluation, large-scale special categories, public-area monitoring). Consult the national DPA's DPIA list.

  2. 2
    Define the processing activity and project scope D+2
  3. 3
    Identify the controller, processors, and responsibilities D+3
  4. 4
    Describe the processing systematically: nature, scope, context, purposes D+4

    Article 35(7)(a): the DPIA must contain a systematic description of the envisaged processing operations and purposes, including the legitimate interest pursued where applicable.

  5. 5
    Document data flows, storage locations, retention periods D+6
  6. 6
    Identify the legal basis for each processing purpose D+7
  7. 7
    Assess necessity and proportionality of the processing D+9

    Article 35(7)(b): assess necessity and proportionality in relation to the purposes. Consider less intrusive alternatives.

  8. 8
    Consult data subjects or their representatives where appropriate D+11
  9. 9
    Identify and describe risks to data subjects' rights and freedoms D+13
  10. 10
    Assess risk likelihood and severity for each identified risk D+14
  11. 11
    Identify measures to address each risk D+16
  12. 12
    Evaluate technical and organisational safeguards (Art. 32) D+18

    Article 32: assess encryption, pseudonymisation, confidentiality/integrity/availability/resilience, and procedures for regular testing and evaluation.

  13. 13
    Document measures demonstrating compliance (Art. 25 by design and by default) D+20
  14. 14
    Consult the Data Protection Officer D+21
  15. 15
    Determine residual risk after mitigation D+23

    If high residual risk remains despite mitigation, prior consultation with the supervisory authority is required (Art. 36).

  16. 16
    Document the DPO's advice and any points of disagreement D+24
  17. 17
    If residual risk is high, initiate Article 36 prior consultation with the SA D+25

    Article 36(3): provide the SA with the DPIA, description of responsibilities, purposes and means, measures and safeguards, contact details, and any other information requested.

  18. 18
    Obtain management sign-off on the DPIA conclusions D+26
  19. 19
    Publish or share the DPIA internally with relevant stakeholders D+27
  20. 20
    Integrate DPIA outcomes into project plans and system requirements D+28
  21. 21
    Schedule periodic DPIA review (at least when risk profile changes) D+29
  22. 22
    Archive the DPIA with supporting evidence D+30
← Back to Dorift