Skip to content
WorkspaceTemplates
The first pages of the Data Protection Impact Assessment template

Data Protection Impact Assessment

Document template for Google Docs and Word

Make a copy in Google Docs
Type
Document
Price
Free
Pages
9 · US Letter
Style
Corporate
Difficulty
Beginner
Updated
October 30, 2026

Every page (9)

Overview

A DPIA fails when it is written after launch or lists risks to the company instead of to the people whose data it holds. This template follows the GDPR order: describe the processing, test necessity, record consultation, score the risks to individuals, list measures with owners and capture the decision. It is a structure to complete with your DPO or counsel, not legal advice.

The sample assesses a fictional wellbeing check-in app from Vesperly Systems used by 62,000 employees. It shows a data flow diagram, a necessity test, five scored risks, a measures scorecard with residual risk and a sign-off page. Replace the system, the data categories, the retention periods and the scores with your own records of processing.

Useful for

  • A product team assessing a new feature that collects personal data before it goes to engineering
  • A data protection officer collecting evidence of necessity, risks and approvals ahead of a regulator's request
  • A security review where controls, owners and residual risk must be shown on one scorecard

What's included

  • Processing description with a layered architecture diagram and the path of one record
  • Necessity page with summary figures and three tests: purpose, minimization and proportionality
  • Consultation clauses recording who was asked and what changed in the design
  • Risk heat map and register scoring likelihood and severity for risks to individuals
  • Measures scorecard with targets, status and residual risk, plus a sign-off page and decision box
  • A make-it-yours guide page with five replacement steps

How to use it

  1. 1

    Click Make a copy in Google Docs, then confirm on the Google page. The copy is saved to your own Google Drive.

  2. 2

    Replace the processing description with your system, its data flow and the people affected, using your records of processing.

  3. 3

    Choose a lawful basis for each purpose with your DPO, then score each risk to individuals and assign a measure, owner and date.

  4. 4

    Record the DPO's advice, the decision-maker and the next review date, and have your counsel check the finished assessment.

  5. 5

    Delete the guide page at the end, then share the document for sign-off.

What you need

Requirements

  • A Google account with access to Google Drive

Works with

  • Google Docs
  • Microsoft Word (download the .docx)

Questions

Is this template legal advice?

No. It is a structure to complete with your data protection officer or counsel. It does not state that any processing activity is lawful, so have the finished DPIA reviewed.

When should the DPIA be completed?

Before the processing starts, while the design can still change. A DPIA finished after launch records a decision that has already been made, which weakens it as evidence.

Are Vesperly Systems and the figures real?

No. The organization, the people named and every figure in the sample are fictional. Replace them with your own system, data categories, scores and approvers.

  • #dpia
  • #data-protection
  • #gdpr
  • #privacy-impact-assessment
  • #risk-register
  • #compliance
  • #google-docs
  • #free-template

Related templates

More Google Docs templatesMore developer workflows templates

More dpia templates

See all 3

Also in Developer workflows

All developer workflows templates
Get this template

    What you get

      Use this templateSee full details

      Preparing your template…