Privacy-first delivery

Data Protection Impact Assessment template

This template mirrors the process we complete before building any solution that processes personal data. It follows UK GDPR Article 35 and the ICO's DPIA guidance so your governance, risk management, and Breath Technology ethos evidence stay aligned.

Save, duplicate, and securely store completed DPIAs alongside your change logs. Everything here can be copied into your documentation system or exported to PDF after completion.

Akadata commitment

"Encryption, least privilege, and transparent audit trails are standard—because trust cannot be outsourced. No analytics traps. No data resale. No hidden tracking. Just lawful stewardship that breathes the same breath as those it serves."

Controller details

Capture who is accountable for the DPIA and how stakeholders contact them.

Name of controller *

Company registration number

DPO title or status

Controller contact name

Email contact *

Date of DPIA completion

Format: DD/MM/YYYY

Step 1 — Identify the need for a DPIA

Summarise the project, its aims, and why a DPIA is required.

Project title *

Date started

Project description

Project contact *

Justification for conducting a DPIA

Systematic and extensive evaluation of personal aspects of individualsProcessing on a large scale of special category or criminal conviction dataSystematic monitoring of a publicly accessible area on a large scaleOther processing that may result in high risk to individuals

Tick all that apply

Step 2 — Describe the processing

Outline how data flows, what you process, who is affected, and the purpose.

Data flow description

Data collection methods

Data sources

Processing activities

Data sharing

List third parties, subprocessors, or integrations

Volume of data

Number of individuals affected

Geographical scope

Retention periods

Context of the processing

Relationship with individuals, expectations, vulnerabilities, public concerns, novelty, and security posture

Purpose of the processing

Include intended effects, broader benefits, lawful basis, and any Article 9 grounds

Step 3 — Consultation process

Record how and when you'll engage stakeholders, processors, and subject matter experts.

Consultation planned?

YesNo

If yes, when and how?

Justification if no consultation

Internal stakeholders involved

External experts consulted

Processor assistance required

Step 4 — Assess necessity and proportionality

Explain how the processing remains lawful, necessary, and proportionate while supporting individual rights.

Necessity assessment

Describe how the processing purpose is clearly defined, necessary, and proportionate.

Compliance measures

Data minimisation, purpose limitation, storage limitation, security

Individual rights support

How you inform and action data subject rights

International transfer safeguards

Adequacy decisions, SCCs/BCRs, derogations, and countries involved

Step 5 — Identify and assess risks

Log each risk, the source, likelihood, severity, and resulting risk grade.

Risk	Source of risk	Nature of impact	Likelihood	Severity	Overall risk

Step 6 — Identify measures to reduce risk

Record how each risk will be reduced, residual risk, and approval status.

Risk	Options to reduce risk	Effect on risk	Residual risk	Measure approved

Step 7 — Sign off and record outcomes

Document who approved mitigation measures, residual risks, and review cadence.

Item	Name / Position / Date	Notes
Measures approved by
Residual risks approved by
DPO advice provided
Summary of DPO advice
DPO advice accepted or overruled by
Comments
Consultation responses reviewed by
Consultation comments
This DPIA will be kept under review by

Project sign-off name

Project sign-off title

Signature

Date

Review date

Next review date

This DPIA reflects our commitment to privacy-first delivery. As detailed in our Why Akadata page, we practise data minimisation and lawful handling as second nature, not compliance theatre. Some say we bleed the same blood — we say we all breathe the same breath.