Template
DPIA (Data Protection Impact Assessment) Template
This template defines the structure of a Data Protection Impact Assessment (DPIA) sufficient to evidence the controller's obligations under GDPR Article 35 and the equivalent obligations under UK GDPR, LGPD Article 38, PIPL Article 55, the EU AI Act (where the processing is part of a high-risk AI system), and Quebec Law 25's privacy impact assessment obligation (Canada, CQLR c. P-39.1, section 3.3).
- Type
- Template
- Version
- 1.0.14
- Date
- 2026-09-25
- Owner
- Data Protection Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Privacy
- Review frequency
- Annual and upon material processing, jurisdiction, or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- How to use this template
- Section 1. Article 35(1) trigger checklist
- Section 2. EDPB WP248 nine-criteria framework
- Section 3. Article 35(7) DPIA content checklist
- Section 4. Sign-off and review
- Framework alignment
- Limitations
Frameworks it maps to
- GDPR
- UK GDPR
- EDPB
- LGPD
- PIPL
- EU AI Act
- ISO/IEC 29134:2023
- ISO/IEC 27701:2025
- NIST Privacy Framework
- Quebec Law 25 (Canada, CQLR c. P-39.1)
Related documents
- Privacy Impact and Cross-Border Transfer Procedureprivacy
- Privacy and Data Governance Policyprivacy
- Record of Processing Activities Templateprivacy
- Automated Decision-Making and Profiling Registerprivacy
- Children's Data Frameworkprivacy
- AI System Impact Assessment Procedureai
Next
All Documents