[Company]

[Street Address, City, ST ZIP Code]

Tel [Telephone] Fax [Fax]

PROJECT: [NAME OF THE PROJECT]

Data Protection Impact Assessment

REVISION CONTROL

DATE AUTHOR
[Date] [Name], [Role] ([Email])

EXECUTIVE SUMMARY

[Short description of the project]

[Purposes of processing]
[Risks identified and mitigation]
[Residual risk]

DESCRIPTION OF THE PROJECT

[Full description and context]

PURPOSE OF PROCESSING

[Description of each purpose, legal basis and categories of personal data]

DATA FLOWS

[Description of all data flows from collection to erasure]

[Included data flow diagrams and tables of personal data processed]
[Included Data Processors and recipients]

IDENTIFICATION AND QUANTIFICATION OF ABSOLUTE RISK

TYPE OF DATA SENSITIVITY RISK

[Name] [Low/High] [Identity theft]
[DoB] [Low/High] [Employees hired after 2016]

GDPR Handbook Template – https://www.gdpr-handbook.eu

 MITIGATION OF RISK

[Description of measures to address the absolute risk]

ASSESSMENT OF RESIDUAL RISK AND PROPORTIONALITY

[Assessment: residual risk at acceptable levels Yes or No]

[Description of necessity and proportionality of the processing]
[Suggestions for other mitigation of risk]

CONSULTATION WITH DATA SUBJECTS (OPTIONAL)

[Documentation of views of Data Subjects about the necessity and the proportionality]

Page 2