How to carry out a DPIA: steps, template and prior consultation

Article 35(7) sets four minimum elements for every data protection impact assessment, and an assessor checks each one separately. The first is a systematic description of the processing and its purposes. An assessor expects to see the data categories, the data subjects, where the data flows between systems and vendors, who can access it, and how long it is kept. A useful test is whether someone outside the project could draw the data flow from the document alone. Purposes must be specific enough to judge the other elements, so "improve services" will not pass where "match returning customers to prior support tickets" would.

The second element is an assessment of necessity and proportionality. Here the controller shows why the processing is needed for the stated purpose, why that purpose cannot be met with less personal data or a less intrusive method, and how minimisation, retention limits and access restrictions keep the processing proportionate. Assessors look for the alternatives that were considered and rejected, with reasons. The third element, the assessment of risks to data subjects, must describe harms to individuals (such as discrimination, financial loss, loss of confidentiality or inability to exercise rights), score their likelihood and severity, and name the source of each risk. Vague statements such as "risk of data breach" fail because they identify no harm, no cause and no basis for the score.

The fourth element is the measures envisaged to address the risks, including safeguards and security measures. Each measure should map to a named risk and state who implements it, how it is verified, and what residual risk remains. Assessors reject lists of generic controls that do not connect to a risk. Confirm with your DPO and your national authority's guidance whether any additional content is expected in your sector, because Article 35(7) sets the minimum rather than the full content. Keep the four elements traceable to one another, since a measure that addresses no listed risk, or a risk with no description of the processing behind it, signals an incomplete assessment.

The European Data Protection Board adopted a DPIA template on 14 April 2026 for public consultation. The template provides predefined fields that walk a controller through the content Article 35(7) requires: a systematic description of the processing and its purposes, the necessity and proportionality assessment, the risks to data subjects, and the measures envisaged to address those risks. Using it does not replace the substance of the assessment. It gives the controller a consistent structure, so the DPO's advice under Article 35(2), the risk register and the eventual review under Article 35(11) can be traced field by field. Note that the template was published for consultation, so treat it as a working format until its final form is confirmed.

Supervisory authorities have two options for the template. A single standard means an authority adopts the EDPB template as the form it expects controllers to use. A meta-template means the authority keeps its own national form, and that form is aligned with the EDPB structure. Your organization may therefore face either a verbatim template or a national variant with different wording and extra questions. Before you start, confirm with your lead supervisory authority, or the authority for each Member State where the processing takes place, which format it has adopted and whether that status has changed since the consultation. Check the authority's website and ask in writing if the answer is unclear.

Record the template version and the date you used it in the DPIA file, along with the authority's stated position. If a national form applies, map each of its fields to the Article 35(7) elements so that an assessor can see that nothing required was left out. Keep the template version under document control, because a later adoption or revision could change field definitions and require you to re-check older assessments during the periodic review. Your DPO should confirm the chosen format before the assessment is finalized.

Prior consultation is triggered when your DPIA shows that processing would still be high risk after you have applied the measures you intend to take. Article 36(1) requires the controller to consult the supervisory authority before processing starts in that situation. The test is applied to the residual risk, not the inherent risk, so the sequence matters: first list the measures in the DPIA, then score the risk that remains once those measures are in place. If the residual score is still high, the authority must be consulted. Keep the scoring method and the reasoning in the DPIA itself, because an assessor or authority will ask how you reached the conclusion.

The controller, not the authority, decides whether mitigation has reduced the risk enough. That judgment belongs to the organization, usually with the DPO's advice under Article 35(2), and it should be recorded with a named owner and a date. Confirm internally who signs off the residual risk rating and what happens if a measure is not yet in place, for example an encryption or access control project still in delivery. A measure you have not implemented cannot count as mitigation, so the residual rating should reflect the current state of the system. Treat that reasoning as part of the record you may later need to produce.

Once consultation is required, Article 36(2) gives the authority up to eight weeks from receiving the request to give written advice where it considers the processing would infringe the GDPR. For complex processing, that period can be extended by six weeks. The authority may use any of its Article 58 powers in that case, which can include ordering changes or limiting processing. Plan the timeline around this window, and confirm with your national authority how it accepts requests and what information it expects. Each EDPB guidance document on DPIAs explains why consultation is the last step of the assessment, not a substitute for it.