A DPIA under GDPR Article 35: whether it is required, the processing described, necessity and proportionality, risks to people, measures and residual risk.
Assesses one processing activity as GDPR Article 35(7) requires. The nine criteria of the WP 248 guidelines show whether a DPIA is likely to be required, each risk to people is rated before and after its measures, and any high residual risk is flagged for prior consultation under Article 36. It supports the controller's decision and gives no legal opinion.
Contents
1. Document Information
2. Summary
3. Is a DPIA Required?
4. Description of the Processing
5. Purposes and Legal Bases
6. Necessity and Proportionality
7. Risks to People
8. Measures
9. Residual Risk and Prior Consultation
10. Advice and Views
11. Points to Settle
12. Recommendations
13. Decision and Review
14. Document Version History
What you provide
Deliverable — Its title, its author and its structure are yours: they steer what is written.
The processing — One processing activity, or a set of similar ones.
Is a DPIA required? — Select what applies. These are the nine criteria of the WP 248 guidelines; national authorities publish further lists.
Necessity and proportionality — Why this processing, and why this much data.
Risks to people — The harm to the people concerned, never the cost to the company. Rate each risk before and after its measures.
