Data Protection Impact Assessment template

This template follows UK GDPR Article 35 and the ICO DPIA process. Save completed copies securely alongside project change logs and governance records.

Controller details

Name of controllerCompany registration numberController addressDPIA leadData Protection OfficerContact emailContact telephone

Project details

Project nameProject ownerProject summaryPlanned start datePlanned review date

Step 1 — Identify the need for a DPIA

What is the project trying to achieve?What types of processing are involved?Why might processing result in a high risk to individuals?

Step 2 — Describe the processing

Nature, scope, context, and purposePersonal data categories and data subject groupsSources, recipients, retention, and international transfers

Step 3 — Consultation

Stakeholders and data subjects consultedAdvice received and actions taken

Step 4 — Necessity and proportionality

Lawful basis and necessityData minimisation, transparency, rights, processor, and transfer safeguards

Step 5 — Identify and assess risks

Risk description and sourceImpact, likelihood, severity, and overall risk level

Step 6 — Identify measures to reduce risk

Risk reference and mitigation optionsEffect, residual risk, and approval status

Step 7 — Sign off and record outcomes

Approvals and DPO adviceProject sign-off name and titleSignatureDateNext review date

Akadata Limited — privacy-first delivery, data minimisation, lawful handling, encryption, least privilege, and transparent audit trails.