# DPIA: <processing activity>

> Draft prepared for review by the DPO / privacy counsel. It is not legal advice; the
> controller decides. Items marked `[to confirm: …]` are unverified and repeated in §7.

| | |
|---|---|
| Controller | <legal entity> |
| Processing activity | <one activity, one line> |
| Business owner | <name, role> |
| DPO | <name> |
| Version / date | 0.1 draft / YYYY-MM-DD |
| Status | Draft for DPO advice |

## 1. Screening: is a DPIA required?

| Criterion | Applies? | Why |
|---|---|---|
| Art. 35(3)(a) systematic, extensive automated evaluation with significant effects | yes / no | |
| Art. 35(3)(b) large-scale special category or criminal offence data | yes / no | |
| Art. 35(3)(c) large-scale monitoring of a publicly accessible area | yes / no | |
| Evaluation or scoring | yes / no | |
| Automated decision-making with legal or similar effect | yes / no | |
| Systematic monitoring | yes / no | |
| Sensitive or highly personal data | yes / no | |
| Large scale | yes / no | |
| Matching or combining datasets | yes / no | |
| Vulnerable data subjects | yes / no | |
| Innovative technology or new organisational solution | yes / no | |
| Prevents people exercising a right or using a service | yes / no | |

**Conclusion:** <DPIA required / recommended / not required>, because <criteria met>.
Supervisory authority's DPIA list checked: <yes, item … / [to confirm]>.

## 2. Description of the processing (Art. 35(7)(a))

**What happens, in order:** <collection → use → sharing → storage → deletion, one line each>

**Purposes:**

| # | Purpose | Lawful basis (Art. 6(1)) | Art. 9(2) condition, if special category | Notes |
|---|---|---|---|---|
| P1 | | | | |

Legitimate interest pursued (where (f) is used): <the interest, stated plainly>

**Data inventory:**

| Data category | Special category / criminal? | Data subjects | Source | Recipients and processors | Location / transfer outside EEA and mechanism | Retention |
|---|---|---|---|---|---|---|
| | | | | | | |

**Scale:** <number of people, volume, frequency, geography>

**Systems and vendors:** <system, vendor, role (processor / controller), contract in place?>

## 3. Necessity and proportionality (Art. 35(7)(b))

| Question | Answer |
|---|---|
| Is each purpose necessary, and does the processing achieve it? | |
| Could less data, less detail or a less intrusive method achieve it? | |
| Is each retention period justified? | |
| How are people told (Arts. 13/14)? Where is the notice? | |
| How do people exercise access, objection, rectification and erasure? | |
| Is any decision made about a person without meaningful human review (Art. 22)? | |
| Are processors bound by an Art. 28 contract? | |
| Were data subjects or their representatives consulted (Art. 35(9))? | |

## 4. Risks to individuals (Art. 35(7)(c))

| # | Risk to the person (harm, who, how it arises) | Likelihood | Severity | Inherent risk |
|---|---|---|---|---|
| R1 | | remote / possible / probable | minimal / significant / severe | low / medium / high |

## 5. Measures and residual risk (Art. 35(7)(d))

| Risk | Measure | Owner | In place / agreed / proposed | Residual likelihood | Residual severity | Residual risk |
|---|---|---|---|---|---|---|
| R1 | | | | | | |

Only measures that are in place or agreed lower the residual risk.

## 6. Prior consultation (Art. 36)

<Residual risks still high: none / R… . View: prior consultation looks needed / does not
look needed, because …. For the DPO to confirm.>

## 7. Open questions for the DPO and the business

| # | Question | Who can answer | Blocks |
|---|---|---|---|
| Q1 | | | §… |

## 8. DPO advice and sign-off

| | |
|---|---|
| DPO advice | |
| Advice followed? If not, why | |
| Residual risks accepted by | |
| Decision (proceed / proceed with measures / do not proceed / consult authority) | |
| Next review date or trigger | |