Data Protection Impact Assessment

DPIA Questionnaire

A working questionnaire built from the EDPB's official DPIA template (v1.0, adopted 10 March 2026). Work through it section by section: start with the overview of the processing, then move into the detailed analysis, risk assessment, and final decision.

Overview

Who the controller and processors are, what the processing is called, and why a DPIA is being carried out.

Detailed analysis

The processing itself, its lawfulness, necessity and proportionality, and the compliance measures in place.

Risk & decision

Inherent and residual risk, the mitigation plan, and the final decision on whether the processing can proceed.

Start with the overview ↓

Overview of the processing

0.1 Controller(s)

If there are joint controllers, add one entry per controller and describe their respective obligations and tasks.

	Controller name	Management units responsible for the processing inside the organisation	Main establishment / point of contact or representative	DPO or similar function, if applicable

0.2 Processor(s) and sub-processor(s)

#	Processor	Definition of their obligations and tasks

0.3 Name of the processing

Internal name given to the processing (as in the record of processing activities) Current version (explain the history of changes made to the processing in the past, if any)

0.4 Planning of the processing

Estimated launch date Estimated end date or expiration conditions (if applicable)

Systematic description of the processing

1.1.a Processed personal data

#	Processed personal data (item or element)	Explanation (data type, data subject category, details)	Special category

1.1.b Purposes of the processing

#	Purpose: specific and explicit reason for processing	Personal data involved (from 1.1.a) and justification

1.1.c Secondary or compatible uses

#	Secondary or compatible use of the data	Personal data involved, conditions, and compatibility assessment

1.1.d Nature, scope and context of the processing

Nature of the processing (how personal data will be handled — operations, technologies, etc.) Scope of the processing (volume/scale, number of data subjects, geographic and organisational reach, frequency or duration) Context of the processing (use cases, business processes, controller status, relationship with data subjects, categories, vulnerable groups) Is this a cross-border processing?

No Yes

Justification and details

Is personal data going to be transferred to a recipient in a third country or international organisation?

No Yes

Justification and details

1.2 Functional description

Ideally supplement this table with one or more data-flow diagrams.

#	Processing phase or stage	Type of operation(s)	Explanation

1.3 Means of processing, supporting assets and underlying architecture

#	Processing phase or stage (from 1.2)	Means of processing and supporting assets	Explanation

1.4 Compliance with approved codes of conduct

#	Code of conduct	Status	Why?

Analysis of the processing

2.1.a Legal basis

One row per purpose/use from 1.1.b and 1.1.c.

#	Purpose / use	Legal basis (Art. 6(1) GDPR)	Justification (analyse legitimate interests / balancing test where relevant)

2.1.b Reasons to lift the processing prohibition

Only needed for special categories of data (Art. 9) identified in 1.1.a.

#	Special category of data (from 1.1.a)	Reason to lift prohibition (Art. 9(2))	Justification

2.2.a Data minimisation and retention periods

#	Processed personal data	Justification of need/relevance	Recipients	Justification	Retention period	Justification

2.2.b Data quality

#	Processed personal data	Quality metrics, requirements or thresholds	Justification

2.3.a Measures supporting compliance with Article 5(1)(a-f) GDPR principles

2.3.b Measures supporting the exercise of data subjects' rights

2.3.c Measures supporting compliance with other GDPR requirements

2.3.d Measures supporting data protection by design and by default (Art. 25)

#	List of supporting measures	Discussion of appropriateness and effectiveness	Status

2.3.e Measures supporting security of processing (Art. 32)

#	List of supporting measures	Discussion of appropriateness and effectiveness	Status

Considerations on necessity and proportionality

3.1 Impacts of the processing on the rights and freedoms of data subjects

#	Threats posed by the processing as designed (incl. mitigating measures)	How can it be materialised?	Risk sources (purpose, wrong design, weaknesses, exposures)	Impact on rights and freedoms

3.2 Assess the necessity of the processing

Is the envisaged processing effective and the least intrusive option for the data subjects' rights and freedoms? Provide evidence (e.g. alternatives considered) and justification.

3.3 Assess the proportionality of the processing

Discuss the importance of the processing and its potential benefits, weighed against the impacts on data subjects' rights and freedoms. Provide evidence and justification.

Risk assessment and management

4.1.a Impacts caused by non-default, accidental, unlawful or abnormal events

Identify, at minimum, threats that could lead to illegitimate access, undesired modification, or disappearance of data.

#	Threats (malfunctions, deviations, CIA/cybersecurity threats)	How can it be materialised?	Risk sources (exposures, errors, vulnerabilities)	Impacts on rights and freedoms

4.1.b Method

Explain the method used to assess and manage risk: likelihood/severity scales and their meaning, risk metrics, prioritisation approach, risk acceptance levels. Link to an external methodology if one is used.

4.1.c Inherent risk assessment

#	Risk to rights and freedoms (from 3.1 / 4.1.a)	Likelihood	Severity	Modulating factors	Risk level	Acceptable?

4.2.a Additional mitigating measures

#	Type of measure	Measure(s)	Mitigated risks (from 4.1.c)	Discussion of appropriateness and effectiveness	Status

4.2.b Residual risk assessment

#	Reassessed risk	Additional mitigating measures applied	Residual likelihood	Residual severity	Residual risk level	Acceptable?

4.2.c Plan

Specific activities to implement the new measures, responsible team, timelines. Include how the measures will be monitored, reviewed and updated once processing begins. Link to external documentation or annexes if relevant.

Involvement of interested parties

5.1 DPO advice

If there is a DPO (or similar function), provide their opinion, conclusions and recommendations on the envisaged processing, and explain how the advice has been implemented.

5.2 Views of data subjects or their representatives

Where appropriate, provide their opinion, conclusions and recommendations, and explain their participation in the DPIA process — or why participation was not sought or not possible.

Conclusion and decision

Based on the assessment of risks and rights, select the decision taken.

Rejected

The processing must be abandoned.

Consultation

The processing will be consulted with the Supervisory Authority.

The data controller cannot find sufficient measures to reduce the risks to an acceptable level (residual risks remain high) and does not wish to abandon the processing. National law requires the controller to consult with, and/or obtain prior authorisation from, the Supervisory Authority (Art. 36(5) GDPR).

Approved

The processing may proceed. The residual risks are acceptable and no national law requires prior consultation or authorisation (Art. 36(5) GDPR).

Conditionally approved

The processing may proceed only after the listed conditions are met.

#	Condition

DPIA Questionnaire

Overview of the processing

0.1 Controller(s)

0.2 Processor(s) and sub-processor(s)

0.3 Name of the processing

0.4 Planning of the processing

0.5 DPIA technical sheet

Systematic description of the processing

1.1.a Processed personal data

1.1.b Purposes of the processing

1.1.c Secondary or compatible uses

1.1.d Nature, scope and context of the processing

1.2 Functional description

1.3 Means of processing, supporting assets and underlying architecture

1.4 Compliance with approved codes of conduct

Analysis of the processing

2.1.a Legal basis

2.1.b Reasons to lift the processing prohibition

2.2.a Data minimisation and retention periods

2.2.b Data quality

2.3.a Measures supporting compliance with Article 5(1)(a-f) GDPR principles

2.3.b Measures supporting the exercise of data subjects' rights

2.3.c Measures supporting compliance with other GDPR requirements

2.3.d Measures supporting data protection by design and by default (Art. 25)

2.3.e Measures supporting security of processing (Art. 32)

Considerations on necessity and proportionality

3.1 Impacts of the processing on the rights and freedoms of data subjects

3.2 Assess the necessity of the processing

3.3 Assess the proportionality of the processing

Risk assessment and management

4.1.a Impacts caused by non-default, accidental, unlawful or abnormal events

4.1.b Method

4.1.c Inherent risk assessment

4.2.a Additional mitigating measures

4.2.b Residual risk assessment

4.2.c Plan

Involvement of interested parties

5.1 DPO advice

5.2 Views of data subjects or their representatives

Conclusion and decision

Justification of the decision (optional)