Drafting a DPIA data protection impact assessment: this is what should be included

Drafting a DPIA (Data Protection Impact Assessment) follows fixed steps: you describe the processing, assess necessity and proportionality, identify the risks to data subjects, and record the measures to control those risks. Article 35, paragraph 7 of the GDPR specifies the minimum components that must be included in the DPIA. If you do this carefully, you will not only have a mandatory document but also a concrete overview of what you need to arrange before starting the processing.

The short answer

1. Describe the processing: purpose, nature, scope, context, and data involved.
2. Test necessity and proportionality: is the processing necessary and proportionate to the purpose?
3. Assess the risks to the rights and freedoms of the data subjects.
4. Determine measures to reduce those risks (technical and organizational).
5. Seek advice from the DPO if you have one (Article 35 paragraph 2 GDPR).
6. Determine the next steps: start, modify, or consult the supervisory authority (Article 36 GDPR).

Drafting a DPIA data protection impact assessment: the mandatory components

Article 35 paragraph 7 of the GDPR lists four components that must be included in the DPIA as a minimum. These form the backbone of the document:

• A systematic description of the intended processing operations and the purposes, including the legitimate interest if you use that as the legal basis.
• An assessment of the necessity and proportionality of the processing in relation to the purposes.
• An assessment of the risks to the rights and freedoms of the data subjects.
• The intended measures to address those risks, including safeguards and security measures to demonstrate the protection of personal data.

These four components are the minimum. In practice, you add a description of the parties involved, the retention periods, and the legal basis for each processing activity, so that the document also serves as accountability to the supervisory authority.

Steps 1 and 2: describe processing and assess necessity

Start with a factual description. Which personal data do you process, from whom, for what purpose, on what legal basis (Article 6 GDPR), and how long do you retain it? Also describe the data flows: who has access, which processors are involved, and is any data transferred outside the European Economic Area?

Next, assess the necessity and proportionality. Can you achieve the goal with less data or with a less intrusive means? The principle of data minimization (Article 5(1)(c) GDPR) is central here. If a less intrusive alternative serves the same purpose, the heavier processing is not proportionate.

Steps 3 and 4: assess risks and determine measures

Assess the risks from the perspective of the data subject, not from that of your organization. Consider identity fraud, discrimination, reputational damage, loss of control over data, or financial damage. Weigh both the probability and the potential impact. For each risk, determine measures: technical (encryption, pseudonymization, access control) and organizational (authorization policy, retention periods, data processing agreements, training).

The goal is to reduce the residual risk to an acceptable level. Document for each risk which measure you take and what residual risk remains. This link makes the DPIA verifiable and demonstrates that you have made a conscious assessment.

Steps 5 and 6: determine FG advice and follow-up

If you have a Data Protection Officer, you must seek their advice when drafting (Article 35(2) GDPR). Document that advice and what you have done with it. Where appropriate, also seek the opinion of the data subjects or their representatives, such as the Works Council regarding processing operations that affect employees.

If the DPIA shows that a high residual risk remains despite your measures, Article 36 of the GDPR requires you to consult the Data Protection Authority beforehand before starting. If the residual risk remains acceptable, you may start and must keep the DPIA up to date.

A practical example: an SME webshop wants to combine customer behavior with external data to build targeted profiles. During the preparation of the DPIA, it becomes apparent that the profiling goes beyond what is necessary for the purpose. The company limits the dataset and removes an external data source, after which the residual risk becomes acceptable and consultation with the supervisory authority is not required.

Honest recommendation

You do not always need a lawyer to draft a DPIA. For straightforward processing with a clear purpose and limited data, you can complete the four components of Article 35(7) of the GDPR yourself using a good template and the guidance from the Dutch Data Protection Authority. However, if the situation becomes complex—for example involving special categories of data, profiling, transfers outside the EEA, or new technology—it is worthwhile to have legal assistance review the process. Assessing necessity and proportionality is often the most difficult part, and this is precisely where things go wrong in practice.

Want to know more? View the DPIA data protection impact assessment, read the explanation of what a DPIA is and how to have a DPIA prepared.

Frequently Asked Questions