DPIA Template Generator

Build a Data Protection Impact Assessment compliant with GDPR Article 35. Covers necessity, proportionality, risk scoring (likelihood × severity), mitigation measures, and residual risk. Export as Markdown.

Compliance Intelligence

DPIAs are mandatory for high-risk processing: profiling, large-scale monitoring, and most AI-powered marketing fits that bar.

GDPR Article 35 requires a DPIA whenever processing is likely to result in a high risk to data subjects. Lookalike audiences, programmatic bidding on behavioural signals, AI content personalisation, and large-scale CRM profiling all meet that threshold. This template follows the ICO's recommended structure and gives you a defensible document when the regulator asks.

1. Project overview

Processing activity name

Business owner

DPIA author + date

Overview of processing

2. Why a DPIA was triggered

Tick all that apply. Any single tick usually requires a DPIA.

Systematic profiling with legal or significant effect Large-scale processing of special categories Systematic monitoring of a publicly accessible area Innovative use of technology (AI, biometrics, IoT) Processing preventing data subjects from exercising a right Data processed to decide access to a service or product Processing of vulnerable individuals (children, employees) Matching or combining datasets from different sources

3. Necessity & proportionality

Lawful basis (Article 6)

How is the processing necessary for the stated purpose?

Have less intrusive alternatives been considered?

How is data minimisation applied?

Retention period and deletion mechanism

4. Risks to data subjects

Score each risk: likelihood (1–5) × severity (1–5). Scores above 15 are high-risk and need mitigation.

5. Consultation

Have data subjects or their representatives been consulted?

Was the DPO consulted?

6. Approval

Residual risk after mitigation

If residual risk is high, has the supervisory authority been consulted?

DPO sign-off

Business owner sign-off

Generated DPIA

Data Protection Impact Assessment

Frequently asked questions

What is a DPIA?

Data Protection Impact Assessment. GDPR Article 35 requires one before high-risk processing. The DPIA documents risks and mitigations.

When is a DPIA required?

Processing likely to result in high risk: systematic profiling with significant effects, large-scale special-category data, systematic monitoring of public spaces, innovative tech (AI, biometrics), vulnerable individuals.

How does it differ from a ROPA?

ROPA is an inventory of all processing (Article 30). DPIA is a deeper risk assessment for specific high-risk activities (Article 35).

Who approves a DPIA?

The DPO reviews. Business owner signs off. If residual risk is high after mitigations, the supervisory authority must be consulted before processing starts.

What is "high residual risk"?

Risk that remains after all mitigations applied. If still rated high (likelihood × severity ≥ 15 in the tool), prior consultation with the regulator is required.

How is likelihood × severity scored?

Each 1 to 5. Product gives a 1 to 25 range. 15+ is high, 9 to 14 medium, below 9 low. Standard DPIA scoring.

Does a DPIA expire?

DPIAs are reviewed when the processing changes materially or when new risks emerge. Many organisations review annually as hygiene.

Can one DPIA cover multiple processing activities?

If they share purpose, data categories, and risk profile: yes. Marketing automation + email broadcast with similar risks can share a DPIA.

Who in the organisation prepares the DPIA?

The business owner of the processing activity, with input from DPO, security, and legal. Not a solo DPO exercise.

Is a DPIA required for existing processing or only new?

Required when processing is likely to result in high risk, regardless of start date. If you have none for existing high-risk activities, catch up.

What triggers a DPIA refresh?

New data sources, new sub-processors, new purposes, new technology, legislative change, or a security incident.

Free · no account

SEORCE for Chrome, Edge and Firefox

Audits the page you are on: headings, meta tags, schema, indexability, and whether AI crawlers can read it. Export the result as a PDF. Free, with no account.

Get for Chrome Get for Edge Get for Firefox

It audits one page at a time and does not track AI answers. About the extension

For teams and agencies

The whole job of search and AI, in one platform.

Rankings, AI visibility, technical fixes, content and reporting sit in one project. Reports export to Excel, PDF and Google Sheets on a schedule, and pricing is per project, never per seat.

Start free Book a demo

3,000+ users · Free forever plan, no card needed