Some processing needs thinking through before it starts, and AI tools and software that score, rank or filter people are high on that list. This assessment works through the need, the processing, consultation, necessity and risk, and ends with a clear outcome and sign-off.

Effective Form Templates

This form template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Form number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested form templates. No junk, jargon or unnecessary content. Simple and usable form templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on assessing processing risk:

• Data Protection and UK GDPR
• Managing Information Security Risks
• ISO 42001 Annex A.5 - Assessing Impacts of AI Systems
• Legal and Compliance knowledge base

Logo Update Service

Download this form template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This form is also included in the GDPR / Data Protection Toolkit and the ISO 27001, ISO 22301 and ISO 22458 toolkits, including the integrated toolkits that combine them, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like hands-on help working through a data protection impact assessment, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Data Protection Impact Assessment Template

A data protection impact assessment (DPIA) template for assessing the risks of a processing activity or project before it goes ahead. It works through six stages, from deciding whether an assessment is needed to the outcome and sign-off, with a risk rating matrix for inherent and residual risk.

What's Included in this Assessment

• Header - description, processing activity or register reference, completed by and date reviewed
• Stage 1 - Assessment of the need for a DPIA - including prompts for AI tools and for software that scores, ranks or filters people
• Stage 2 - Describe the Processing
• Stage 3 - Consultation Process
• Stage 4 - Assessment of Necessity and Proportionality
• Stage 5 - Assessment of risk and controls to mitigate risk - each risk with its inherent rating, controls in place and residual rating
• Stage 6 - Outcome and Sign-off

Who Needs a Data Protection Impact Assessment?

Any organisation planning processing that could be high risk to individuals - introducing an AI tool that handles personal data, automated screening of job applicants, monitoring, new systems or large amounts of special category data.

Included in the GDPR / Data Protection Toolkit

This form is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download, and is also included in the ISO 27001, ISO 22301 and ISO 22458 toolkits.

Works with the Personal Data Register

The processing activity or register reference links each assessment back to the entry in your register, such as the F-IMS30 Record of Processing Activities Register or ER21 Personal Data Register, which record whether an assessment was needed.

Using the Assessment

Carry out the assessment before the processing starts, and involve the people who will run it. Record the processing activity or register reference so the assessment can be found from the register, describe the risks honestly, and sign off the outcome. Revisit it if the processing changes.

When AI Is Involved

An AI tool that handles personal data, or software that scores, ranks or filters people, should be assessed before it is used. Useful questions include what personal data the tool receives, where it goes, whether it is used to train the provider's models, what the tool creates, how accurate it is, and how a person reviews its output before anyone is affected.

Keeping the Outcome

Keep the completed assessment with the processing record, and make sure any actions it identifies are carried out before the processing goes ahead.

Related Documents

Other documents in the GDPR / Data Protection Toolkit that work alongside this one:

• F-IMS30 Record of Processing Activities Register
• F-Q99 Record of Processing Form
• PP-1-16 Data Protection Policy Procedure