DPIA template (data protection impact assessment)
A data protection impact assessment (DPIA) checks a planned use of personal data for risks to the people it's about, before it starts, and records how you'll reduce them. This free Word template follows the seven steps of the ICO's DPIA guidance and its sample template, from screening to sign-off.
Running a company of 30 to 200 people? Documents like this are now worth money.
Under UK GDPR a DPIA is compulsory when processing is likely to result in a high risk to people's rights and freedoms. Step 1 screens for that, so you can show why you did one or didn't.
What's in the template
Data protection impact assessment (DPIA)
| Project | |
|---|---|
| Controller | |
| DPIA owner | |
| Data protection officer | Name, or 'none' and who advised instead |
| Version and date |
Step 1: Identify the need for a DPIA
Describe the project. A DPIA is required if anything in list A applies, or anything in list B plus anything in list C.
List A
- Automated evaluation or profiling behind decisions with legal or similar effects
- Large-scale special category or criminal offence data
- Large-scale systematic monitoring of a public area
- Automated decisions or special category data deciding access to products, services, opportunities or benefits
- Large-scale profiling
- Matching or combining data from several sources
- Children's or vulnerable people's data used for marketing, profiling or automated decisions; online services offered directly to children
- A breach could endanger physical health or safety
List B
- New technology, or a novel use of existing technology
- Biometric data used to identify people
- Genetic data, unless a GP or health professional is providing care
- Data not obtained from the people, where telling them is impossible or disproportionate
- Tracking location or behaviour
List C (two or more usually call for a DPIA on their own)
- Evaluation or scoring
- Automated decisions with legal or similar effects
- Systematic monitoring
- Sensitive or highly personal data
- Large scale
- Matching or combining datasets
- Vulnerable people
- Innovative technology
- Blocks a right, service or contract
| Outcome and reasons | |
|---|---|
| Decided by and date |
Step 2: Describe the processing
| Nature | How data is collected, used, stored, shared and deleted |
|---|---|
| Scope | What data, how much, how long, how many people |
| Context | People's expectations and control; vulnerable groups; anything novel |
| Purposes | Aims, benefits and effect on people |
Step 3: Consultation
| Who | How and when | Views and changes made |
|---|---|---|
| People affected or their representatives | ||
| Information security | ||
| Processors | ||
| DPO or data protection lead |
Step 4: Necessity and proportionality
| Lawful basis and any special category condition | |
|---|---|
| Achieves the purpose? Less intrusive option? | |
| Function creep, minimisation and accuracy | |
| Information for people; their rights | |
| Processors; international transfers |
Step 5: Identify and assess risks
Likelihood: remote, possible or probable. Severity: minimal, significant or severe. Overall: low, medium or high.
| Risk to individuals | Likelihood | Severity | Overall |
|---|---|---|---|
Step 6: Identify measures to reduce risk
| Risk | Measure | Effect: eliminated, reduced or accepted | Residual risk | Approved? |
|---|---|---|---|---|
Step 7: Sign off and record outcomes
| Item | Name, position, date | Notes |
|---|---|---|
| Measures approved by | Actions added to the project plan | |
| Residual risks approved by | High risk left: consult the ICO first | |
| DPO advice | Summary; reasons if overruled | |
| Consultation responses reviewed by | Reasons if departing from people's views | |
| Review owner | Next review date |
When a DPIA is required
UK GDPR, Article 35. You must assess processing that is likely to result in a high risk to people's rights and freedoms before it starts. Three cases always qualify: automated evaluation or profiling behind decisions with legal or similarly significant effects; large-scale special category or criminal offence data; and large-scale systematic monitoring of a publicly accessible area.
The ICO's list. Five of its ten types need a DPIA on their own (list A). The other five, including tracking and biometrics, need one when combined with any of the nine screening criteria from the European guidelines (list C). Two criteria together usually point to one as well. If you decide against a DPIA, record why. The ICO is reviewing this guidance after the Data (Use and Access) Act 2025.
How to carry out a DPIA
- Screen at the idea stage, before choosing a supplier; the ICO expects a DPIA to run alongside planning.
- Map the data from collection to deletion: sources, systems, access, sharing.
- Consult the people affected or their representatives unless there's a good reason not to (record it), plus whoever handles information security.
- Challenge the need. Record the less intrusive options and why each falls short.
- Score harm to people, not the company: intrusion, unfair decisions, discrimination, financial loss, distress. A significant chance of very serious harm can make a risk high.
- Sign off. If you have a DPO you must seek their advice; record it, and why if you overrule it.
- Consult the ICO if a high risk remains, and don't start until you have; it says it replies within eight weeks, or 14 if complex. Then add the actions to your project plan.
Example: van tracking at a fictional 80-person courier firm
A fictional courier plans telematics and dashcams for its 50 vans. Tracking drivers, combined with systematic monitoring and scoring of their driving, meets the ICO's test. From steps 5 and 6:
| Risk to individuals | Likelihood | Severity | Overall | Measure agreed | Residual |
|---|---|---|---|---|---|
| Location reveals drivers' breaks and off-shift trips | Probable | Significant | High | Private mode outside shifts; break stops hidden | Low |
| Driving scores used for warnings without context | Possible | Significant | Medium | Scores discussed with the driver before any action | Low |
| Driver-facing camera recording all day | Probable | Severe | High | Dropped: road-facing cameras only | None |
| Supplier breach exposes journey histories | Possible | Significant | Medium | Processor contract; multi-factor sign-in; 12 months' history | Low |
Drivers objected to the in-cab camera at depot briefings, so it was dropped. With no high risk left, no ICO consultation was needed.
Common mistakes
- Starting after the contract is signed, when the DPIA can only justify decisions already made.
- Listing only security threats. Unfairness and intrusion into private life count too.
- Never reopening it. The ICO calls a DPIA a living process.
Frequently asked questions
Is a DPIA mandatory?
Only when processing is likely to be high risk: the three Article 35(3) cases and anything meeting the ICO's list. Otherwise it's optional, though the ICO recommends one if you're unsure. Standing rules belong in a data protection policy.
Do we have to publish our DPIA?
No. The ICO calls publishing good practice, not a duty; leave out security details that could help an attacker.
What if we skip a DPIA we needed?
The ICO says failing to carry out a required DPIA can lead to enforcement action, including a fine of up to £8.7 million.
The template follows the ICO's structure, but it isn't legal advice.
Sources
- ICO: Data protection impact assessments (DPIAs)
- ICO: When do we need to do a DPIA?
- ICO: Examples of processing likely to result in high risk
- ICO: How do we do a DPIA?
- ICO: What is a DPIA?
- ICO: Do we need to consult the ICO?
- ICO: Sample DPIA template (Word)
- legislation.gov.uk: UK GDPR, Article 35 (data protection impact assessment)
- legislation.gov.uk: UK GDPR, Article 36 (prior consultation)