Data Privacy Impact Assessment (DPIA) Template

{ "Title": "Data Privacy Impact Assessment (DPIA) Template", "IntroductionHtml": "

This interactive DPIA helps teams quickly evaluate privacy risks, document mitigation decisions, and capture required approvals. Use the fields below to describe the project, identify personal data involved, record the lawful basis, score likelihood and impact, list mitigations, and record approvals. An example filled DPIA for a user analytics pipeline is included to show a practical, minimal response.

Example (filled) — User analytics pipeline

Project summary: Collect event data from web and mobile apps to understand feature usage and improve onboarding. No health or financial data; identifiers are limited to a hashed user id and email for account linking.

Lawful basis: Legitimate interests (product improvement). Balance test performed; sensitive data avoided; opt-out respected for marketing cookies.

Data types: Identifiers (hashed user id), contact (email), behavioral (event data), device (user agent), location (coarse city level).

Mitigations: Data minimization, pseudonymization (hashing), encryption in transit and at rest, RBAC for analytics team, 90-day event retention then aggregation to 12-month monthly summaries, DPAs with vendor analytics provider.

Risk scoring: Likelihood 2, Impact 3 → Estimated risk: Medium. Residual risk accepted by DPO pending anonymization of any records used for support.

", "SubmitLabel": "Save DPIA", "SuccessMessage": "DPIA saved. You can export or update this assessment later and notify approvers as needed.", "DataType": "privacy-dpia", "SchemaVersion": "1.0", "Fields": [ {"Key": "project_summary", "FieldType": "textarea", "Label": "Project summary", "HelpText": "Briefly describe the project, purpose, scope, and intended outcomes (2–5 sentences).", "Required": true}, {"Key": "project_owner", "FieldType": "text", "Label": "Project owner / team", "HelpText": "Name and role of the person responsible for this DPIA.", "Required": true}, {"Key": "contact_email", "FieldType": "text", "Label": "Contact email", "HelpText": "Contact address for questions."}, {"Key": "data_purpose", "FieldType": "textarea", "Label": "Purpose of data processing", "HelpText": "Why are you collecting or using personal data? Be specific about the intended outcomes."}, {"Key": "personal_data_types", "FieldType": "checkbox", "Label": "Types of personal data involved", "Options": [ {"Value": "identifiers", "Label": "Identifiers (name, ID)"}, {"Value": "contact", "Label": "Contact details (email, phone)"}, {"Value": "financial", "Label": "Financial data"}, {"Value": "health", "Label": "Health or medical data"}, {"Value": "device", "Label": "Device/technical identifiers (IP, device id)"}, {"Value": "behavior", "Label": "Behavioral data (events, clicks)"}, {"Value": "location", "Label": "Location data"}, {"Value": "special", "Label": "Special category / sensitive data"}, {"Value": "other", "Label": "Other (explain below)"} ], "HelpText": "Check all that apply. If you select 'Other', explain in the Other personal data types field."}, {"Key": "other_personal_data", "FieldType": "textarea", "Label": "Other personal data types (if any)", "HelpText": "Describe any other data types not listed above."}, {"Key": "lawful_basis", "FieldType": "select", "Label": "Lawful basis for processing", "Options": [ {"Value": "consent", "Label": "Consent"}, {"Value": "contract", "Label": "Contractual necessity"}, {"Value": "legal", "Label": "Legal obligation"}, {"Value": "vital", "Label": "Vital interests"}, {"Value": "public_task", "Label": "Public task"}, {"Value": "legitimate", "Label": "Legitimate interests"}, {"Value": "none", "Label": "Not yet determined"} ], "Required": true, "HelpText": "Select the primary lawful basis. If you select 'Legitimate interests', complete the legitimate interests assessment field."}, {"Key": "legitimate_interests_assessment", "FieldType": "textarea", "Label": "Legitimate interests assessment (if applicable)", "HelpText": "If relying on legitimate interests, describe purpose, necessity, balancing of rights, and safeguards."}, {"Key": "data_flow", "FieldType": "textarea", "Label": "Data flow and third-party sharing", "HelpText": "Describe where data originates, downstream systems, third-party processors, and any cross-border transfers."}, {"Key": "storage_location", "FieldType": "text", "Label": "Storage location and systems", "HelpText": "Identify storage systems, cloud providers, databases, and geographic regions."}, {"Key": "retention_period", "FieldType": "text", "Label": "Retention period and deletion plan", "HelpText": "How long will personal data be kept? Include retention schedule and deletion/archival processes."}, {"Key": "access_controls", "FieldType": "textarea", "Label": "Access control and security measures", "HelpText": "Describe authentication, RBAC, encryption at rest/in transit, and logging practices."}, {"Key": "likelihood", "FieldType": "scale", "Label": "Likelihood of harm (1 low – 5 high)", "Scale": {"Min": 1, "Max": 5, "Step": 1}, "HelpText": "Rate the likelihood that a privacy event could occur without mitigations."}, {"Key": "impact", "FieldType": "scale", "Label": "Impact of harm (1 low – 5 high)", "Scale": {"Min": 1, "Max": 5, "Step": 1}, "HelpText": "Rate the potential severity if a privacy incident occurs (reputational, financial, individual harm, regulatory)."}, {"Key": "calculated_risk", "FieldType": "select", "Label": "Estimated risk level (user-calculated)", "Options": [ {"Value": "low", "Label": "Low (1–6)"}, {"Value": "medium", "Label": "Medium (7–12)"}, {"Value": "high", "Label": "High (13–25)"} ], "HelpText": "Multiply likelihood × impact and select the corresponding level: 1–6 low, 7–12 medium, 13–25 high."}, {"Key": "mitigations", "FieldType": "checkbox", "Label": "Mitigation approaches to apply", "Options": [ {"Value": "minimization", "Label": "Data minimization"}, {"Value": "pseudonymization", "Label": "Pseudonymization / anonymization"}, {"Value": "encryption", "Label": "Encryption (in transit & at rest)"}, {"Value": "access_restrictions", "Label": "Access restrictions & RBAC"}, {"Value": "logging_monitoring", "Label": "Logging and monitoring"}, {"Value": "dp_contracts", "Label": "Data processing agreements (DPAs)"}, {"Value": "training", "Label": "Staff training & awareness"}, {"Value": "other_mit", "Label": "Other (describe below)"} ], "HelpText": "Select mitigation measures planned."}, {"Key": "other_mitigations", "FieldType": "textarea", "Label": "Other mitigations (if any)", "HelpText": "Describe any additional technical or organizational controls."}, {"Key": "residual_risk", "FieldType": "textarea", "Label": "Residual risk after mitigations", "HelpText": "Describe remaining risk, acceptance rationale, or compensating controls."}, {"Key": "data_subject_rights", "FieldType": "textarea", "Label": "How data subject rights will be supported", "HelpText": "Describe processes for access, rectification, erasure, portability, objection, and consent withdrawal."}, {"Key": "third_party_assessments", "FieldType": "textarea", "Label": "Third-party / processor assessments", "HelpText": "List processors, evidence of certification (SOC2, ISO27001), and contract links."}, {"Key": "approvals_required", "FieldType": "checkbox", "Label": "Approvals required", "Options": [ {"Value": "dpo", "Label": "Data Protection Officer"}, {"Value": "legal", "Label": "Legal / Compliance"}, {"Value": "security", "Label": "Security / IT"}, {"Value": "product", "Label": "Product / Engineering"}, {"Value": "business_owner", "Label": "Business owner"}, {"Value": "other_approver", "Label": "Other (specify in Approval notes)"} ], "HelpText": "Select all approvers required for this project."}, {"Key": "approval_notes", "FieldType": "textarea", "Label": "Approval notes and signatures", "HelpText": "Record approval names, dates, and comments. Use this field to capture evidence of review."}, {"Key": "attachments", "FieldType": "text", "Label": "Related documents or links", "HelpText": "Links to architecture diagrams, contracts, privacy policy, or an example filled DPIA."} ] }