Some processing needs thinking through before it starts, and AI tools and software that score, rank or filter people are high on that list. This assessment works through the need, the processing, consultation, necessity and risk, and ends with a clear outcome and sign-off.
This form template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Form number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested form templates. No junk, jargon or unnecessary content. Simple and usable form templates
developed over 25 years through practical use in the real world.
Further guidance on assessing processing risk:
Download this form template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This form is also included in the GDPR / Data Protection Toolkit and the ISO 27001, ISO 22301 and ISO 22458 toolkits, including the integrated toolkits that combine them, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help working through a data protection impact assessment, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Data Protection Impact Assessment Template
A data protection impact assessment (DPIA) template for assessing the risks of a processing activity or project before it goes ahead. It works through six stages, from deciding whether an assessment is needed to the outcome and sign-off, with a risk rating matrix for inherent and residual risk.
What's Included in this Assessment
- Header - description, processing activity or register reference, completed by and date reviewed
- Stage 1 - Assessment of the need for a DPIA - including prompts for AI tools and for software that scores, ranks or filters people
- Stage 2 - Describe the Processing
- Stage 3 - Consultation Process
- Stage 4 - Assessment of Necessity and Proportionality
- Stage 5 - Assessment of risk and controls to mitigate risk - each risk with its inherent rating, controls in place and residual rating
- Stage 6 - Outcome and Sign-off
Who Needs a Data Protection Impact Assessment?
Any organisation planning processing that could be high risk to individuals - introducing an AI tool that handles personal data, automated screening of job applicants, monitoring, new systems or large amounts of special category data.
Included in the GDPR / Data Protection Toolkit
This form is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download, and is also included in the ISO 27001, ISO 22301 and ISO 22458 toolkits.
Works with the Personal Data Register
The processing activity or register reference links each assessment back to the entry in your register, such as the F-IMS30 Record of Processing Activities Register or ER21 Personal Data Register, which record whether an assessment was needed.
Using the Assessment
Carry out the assessment before the processing starts, and involve the people who will run it. Record the processing activity or register reference so the assessment can be found from the register, describe the risks honestly, and sign off the outcome. Revisit it if the processing changes.
When AI Is Involved
An AI tool that handles personal data, or software that scores, ranks or filters people, should be assessed before it is used. Useful questions include what personal data the tool receives, where it goes, whether it is used to train the provider's models, what the tool creates, how accurate it is, and how a person reviews its output before anyone is affected.
Keeping the Outcome
Keep the completed assessment with the processing record, and make sure any actions it identifies are carried out before the processing goes ahead.
Related Documents
Other documents in the GDPR / Data Protection Toolkit that work alongside this one:
Would you rather we prepared it for you?
Our Personal Data Register and Privacy Notice Preparation service works through the personal data your organisation holds with you, including the AI tools in use, and prepares the register and privacy notice so they describe what actually happens to that data.
Personal Data Register and Privacy Notice Preparation