DPIA Generator

About the DPIA Generator

A data protection impact assessment (DPIA) is required before processing that is likely to result in a high risk to people’s rights and freedoms — always for large-scale special category data, systematic monitoring of public places and automated decisions with significant effects (GDPR Article 35). It describes the processing, tests its necessity and proportionality, assesses the risks and records the measures that address them.

Start with the screening: the three cases of Article 35(3), the nine criteria of the European guidelines (WP 248) — two or more mean a DPIA in most cases — the ICO’s own list for the UK, and the yearly DPIA of an Indian Significant Data Fiduciary. Then build the assessment in the seven steps of the ICO’s template: the need, the description, consultation, necessity and proportionality, a risk register with each risk rated for likelihood and severity before and after the measures on the ICO’s matrix, and the sign-off with the DPO’s advice. A high residual risk is flagged for prior consultation with the supervisory authority (Article 36). The free preview shows every page with your answers and the first part of the wording; a Premium pass unlocks the DOCX and PDF.

Common uses

• A product team launching an app that profiles users or uses location, health or biometric data.
• An employer bringing in monitoring, wellbeing or access-control technology for staff.
• A DPO screening new projects and keeping a record of why some need no DPIA.
• An Indian Significant Data Fiduciary preparing its yearly assessment.

When a DPIA is required

• Article 35(3) names three cases: a systematic and extensive evaluation of people, based on automated processing including profiling, on which decisions with legal or similarly significant effects are based; processing special category or criminal data on a large scale; and systematic monitoring of a publicly accessible area on a large scale.
• The European guidelines add nine criteria: evaluation or scoring; automated decisions with legal or similar effect; systematic monitoring; sensitive or highly personal data; large scale; matching or combining datasets; vulnerable people such as children, employees or patients; innovative technology; processing that prevents people from using a right, a service or a contract. In most cases two criteria mean a DPIA is needed; sometimes one is enough (WP 248).
• Each supervisory authority publishes a list of its own (Article 35(4)). The ICO’s list has five kinds of processing that need a DPIA on their own — such as large-scale profiling, data matching or targeting children — and five that need one together with a criterion, such as biometrics, genetic data or tracking.
• If you decide no DPIA is needed, record why. Carry it out before the processing starts and review it when the risk changes (Article 35(11)).

What the assessment contains

• A systematic description of the processing and its purposes, including any legitimate interest pursued (Article 35(7)(a)).
• An assessment of its necessity and proportionality: the lawful basis, whether it achieves the purpose, less intrusive alternatives, data minimisation, the information given to people, their rights, processors and transfers (Article 35(7)(b)).
• An assessment of the risks to people’s rights and freedoms (Article 35(7)(c)) and the measures to address them, with safeguards and security (Article 35(7)(d)).
• The advice of the data protection officer (Article 35(2)) and, where appropriate, the views of the people affected or their representatives (Article 35(9)).

Rating the risks

Each risk gets a likelihood of harm — remote, possible or probable — and a severity — minimal, significant or severe. The overall risk follows the matrix of the ICO’s DPIA guidance: a remote harm or a minimal one is low risk; a possible harm of significant severity is medium; a possible severe harm, or a probable harm that is significant or severe, is high. After the measures, the residual risk is rated the same way. If a high residual risk remains and you accept it, you must consult the supervisory authority before the processing starts (Article 36(1)) — in the UK, the ICO.

India: Significant Data Fiduciaries

Under the DPDP Act, 2023 a Significant Data Fiduciary carries out a periodic DPIA — describing the rights of Data Principals and the purpose of processing, and assessing and managing the risk to those rights (section 10(2)(c)). The DPDP Rules require it, with an audit, once in every twelve months from notification, and a report of the significant observations to the Data Protection Board (rule 13).

Official sources

• Regulation (EU) 2016/679 (GDPR) — Articles 35 and 36
• WP 248 rev.01: guidelines on DPIAs — the nine criteria
• ICO: how do we do a DPIA? and when do we need to do a DPIA?
• Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025

Limitations

• A structured template, not legal advice: the answers, ratings and decisions are yours and your DPO’s.
• Supervisory authorities’ own lists differ from country to country: check the list of the authority for your country (the tool includes the ICO’s).
• It does not replace a security risk assessment or a transfer risk assessment; refer to them in the answers where they exist.
• The Indian section describes the duties of a notified Significant Data Fiduciary; which fiduciaries are notified, and any data to be kept in India, depend on government notifications.

Privacy

On this device; its files download once

Everything happens in your browser. Your project details and risk register are not uploaded or stored by MySmartCoPilot. If you tick Keep a draft in this browser, the form is saved in this browser’s local storage until you untick it.