DPIA / PIA Template & Records of Processing Activities (RoPA) – Document Builder 👷‍♂️

Please enable JavaScript in your browser to complete this form.

🌍 Jurisdiction & Basics — Step 1 of 10 – Step 1 of 11

🌍 Jurisdiction & Basics

Country, language, template type, organisation, and assessment dates.

Country *

Language of the completed document *

Template Type *

Organisation / Controller Legal Name *

Assessment Title / Project Name *

Assessment Start Date *

Date

Time

Assessment Target Completion Date *

Date

Time

🧾 Processing Overview

Describe the purpose, scope, and systems/vendors involved.

Processing Purpose (why is the data processed?) *

Processing Description (what happens to the data end-to-end?) *

Systems/Apps Involved (comma-separated) *

Is this processing new or a change to existing processing? *

If Change/Update: what changed and why?

👥 Roles & Stakeholders

Identify controller(s), processor(s), DPO, and key contacts.

Data Protection Officer (DPO) / Privacy Contact Name

DPO / Privacy Contact Email

Business Owner / Process Owner (name, role, email) *

Key Processor(s) / Vendor(s) (name, role, location) *

Are there joint controllers involved? *

If Yes: list joint controller(s) and responsibilities split (Art.26 summary)

🗂️ Data Map

Data subjects, personal data categories, special categories, and volume.

Data Subjects *

Customers/End users
Employees
Contractors
Prospects/Leads
Children (under applicable age)
Other

If Other data subjects: specify

Personal Data Categories (e.g., contact, identifiers, usage logs) *

Special Category Data (GDPR Art.9) or Sensitive Data involved? *

If Yes: specify special/sensitive categories and safeguards

Approximate Volume *

⚖️ Legal Basis, Retention & Transfers

Lawful bases, retention, storage locations, and cross-border transfers.

Lawful Basis (select all that apply) *

Consent
Contract necessity
Legal obligation
Vital interests
Public task
Legitimate interests

If Legitimate Interests: describe LI and balancing test summary

Retention Period / Deletion Rule (e.g., 2 years after last activity) *

Primary Storage Location(s) (country/region, cloud provider, data centers if known) *

Cross-border transfers outside the data subject's region? *

If Yes: transfer destinations + mechanism (SCCs/IDTA/BCR/adequacy)

📏 Necessity & Proportionality

Why the processing is necessary; minimisation, access control, transparency.

Why is this processing necessary to achieve the purpose? *

Data minimisation measures (only collect what is needed) *

Transparency/Notices (what do users get told, when, and how?) *

Access controls (who can access; role-based; logging) *

🧨 Risk Assessment

Identify key risks to individuals and rate likelihood/impact.

Key Risks to Data Subjects (list and describe) *

Overall Likelihood *

Overall Impact/Severity *

Is there a high risk requiring consultation (e.g., GDPR Art.36)? *

If Yes: explain why; proposed consultation steps

🛡️ Measures & Controls

Security and privacy measures to reduce risks (technical & organisational).

Controls Implemented (select all that apply) *

Encryption in transit
Encryption at rest
MFA / strong authentication
Least privilege / RBAC
Audit logging & monitoring
Backups & disaster recovery
Data retention & deletion automation
Vendor due diligence / DPA in place
Incident response plan
Regular security testing
Other

If Other controls: specify

Residual Risk After Controls (summary) *

📚 RoPA (Record of Processing Activities)

Populate the RoPA entries for this processing activity.

Processing Activity Name *

Categories of Recipients (internal, external) *

International Transfers (details)

Technical & Organisational Security Measures (RoPA summary) *

✍️ Approvals, Sign‑Off & Attachments

Approvals, signatures, dates, and uploads.

Final Acknowledgements (must check all) *

Assessment completed in good faith based on available information
Controls listed are implemented or planned as stated
We will update this assessment if processing changes materially

Approver Name / Role *

Approval Date *

Date

Time

Prepared By (name) *

Prepared Date *

Date

Time

Attachments (data maps, policies, vendor docs, etc.)

Drag & Drop Files, Choose Files to Upload You can upload up to 10 files.