A data protection impact assessment (DPIA) describes a processing operation, assesses the risks to data subjects and records the measures to reduce them. Under GDPR Art. 35 it is mandatory when processing is likely to result in a high risk; Brazil’s LGPD calls it a RIPD (Art. 38). This template builds a structured draft with a screening step, a likelihood and severity risk matrix and a section for AI systems.
How to use
- Describe the project, the controller, the applicable law and what happens to the data.
- Tick the data categories and high-risk criteria: the screening tells you whether a DPIA is likely required.
- List the risks to data subjects with likelihood, severity and the measure that reduces each one.
- If the processing uses AI or automated decisions, fill in the purpose and human oversight.
- Review the draft with your DPO and export it as DOCX to circulate and approve.
What each field asks for
| Field | What to enter |
|---|---|
| Project or processing name | The system, process or change being assessed. |
| Controller | The organisation that decides on the processing. |
| Applicable law | The GDPR calls the document a DPIA (Art. 35); the LGPD calls it a RIPD (Art. 38). |
| Description of the processing | What happens to the data from start to finish: collection, use, systems and who is involved. |
| Purposes | Why the data is processed. One specific purpose per line. |
| Data categories | Tick every category the processing uses. |
| Data subjects | Whose data it is. |
| Recipients and processors | Who receives the data or processes it on behalf of the controller. |
| International transfer | Whether the data leaves the country, and under which mechanism. |
| Retention period | How long the data is kept, or the criterion used. |
| High-risk criteria | Criteria from the EDPB guidelines. Two or more suggest a DPIA is likely required. |
| Does it use AI or automated decisions? | If so, the assessment gains an AI impact section. |
| Purpose of the AI system | Only if AI is used. What the model estimates, classifies or decides. |
| Human oversight | Only if AI is used. Who reviews the decisions and when. |
| Risk | E.g. discriminatory refusals caused by model bias |
| Likelihood | |
| Severity | |
| Mitigation measure | E.g. bias testing by group before launch |
| DPO consulted? | Choose |
| Next review date | E.g. 30 April 2027 |
Example
A fictional retailer plans to use a scoring model to approve instalment purchases. It ticks four high-risk criteria (scoring of people, automated decisions, large scale and innovative technology), so the screening says a DPIA is likely required. Of the three risks listed, discriminatory refusals caused by model bias come out high (medium likelihood, high severity), decisions without human review medium and excessive retention low. The draft adds the AI section and the residual risk guidance for the GDPR and the LGPD.
When to use
- Before launching new processing that uses sensitive data, children’s data or monitoring.
- When an AI system or automated decision starts to affect customers, candidates or employees.
- When a regulator, a client or an audit asks for the impact assessment of existing processing.
- When you change the purpose, scale or technology of processing already assessed.
Frequently asked questions
When is a DPIA mandatory under the GDPR?
Article 35 requires a DPIA when processing is likely to result in a high risk to people’s rights and freedoms, for example systematic profiling with significant effects, large-scale special category data or systematic monitoring of public areas. Supervisory authorities also publish lists of operations that always need one.
What is the difference between a DPIA and a RIPD?
They play the same role: describe the processing, assess risks and record measures. DPIA is the GDPR term, and the GDPR requires prior consultation with the authority when a high risk remains. RIPD is the term in Brazil’s LGPD, where the ANPD may request the report. This template works for both.
How does the tool decide whether a DPIA is needed?
It uses the rule of thumb in the EDPB guidelines on DPIAs: two or more high-risk criteria, such as scoring people or large-scale sensitive data, suggest an assessment is likely required. With one criterion, assess case by case. It is an initial screening, not a final decision.
How is each risk level calculated?
The level is likelihood multiplied by severity, each from 1 to 3. Up to 2 is low, 3 or 4 is medium, 6 or 9 is high. The matrix structures the discussion; the judgement on each risk stays with the team and the DPO.
What changes when the processing uses AI?
The draft gains a section with the purpose of the model, human oversight and questions on bias, explainability, training data and monitoring. If the system is high-risk under the EU AI Act, a fundamental rights impact assessment may also be needed.
Is the result legal advice?
No. It is an educational tool that produces a structured draft. Review the content with your DPO and legal counsel, and check the rules currently in force before approving the assessment.
Which DPCert certification covers DPIAs?
The DPAI (Data Protection & AI Professional) assesses accountability tools, including the DPIA and the record of processing activities. The RAIP (Responsible AI Practitioner) goes deeper into risk and impact assessment for AI systems.