Data Protection Impact Assessment
Docs + Word9 pages
Free
- Type
- Document
- Price
- Free
- Pages
- 8 · US Letter
- Style
- Minimal
- Difficulty
- Beginner
- Updated
- November 5, 2026
Every page (8)
Overview
A data protection impact assessment asks whether a system that handles personal data is necessary and proportionate, and what it could do to the people in it. This template organises that work into its core pages: the processing, the lawful basis, special category data, risks, measures and the DPO's advice. Each page has one purpose, so the data protection officer can check the basis first while product teams read the measures and the data flow.
The sample describes Willowmere Systems' messaging service for clinics, with five risks scored for likelihood and impact, a scorecard of three controls and an outcome that allows the processing to go ahead on three conditions. Replace the processing description, data categories, retention periods and recipients with entries from your own records of processing, then score each risk to individuals and assign an owner and a date to every measure. The people, organisation and figures are fictional sample data.
Useful for
- A clinic group assessing a new patient messaging service before launch
- A health tech team recording special category data for a DPO review
- A product lead preparing evidence for a regulator's request for records
What's included
- Processing: system layers, request flow and the data stores involved
- Lawful basis: one basis per purpose, with the necessity test beside it
- Special category data: record types, shares and access controls
- Risks: a heat map and a register of five risks, owners and responses
- Measures: a scorecard with targets, actuals and plain definitions
- DPO advice: the review steps, escalation route and sign-off
How to use it
- 1
Click Make a copy in Google Docs, then confirm on the Google page. The copy is saved to your own Google Drive.
- 2
Replace the processing description, data flow and people affected with your own system.
- 3
Choose one lawful basis per purpose and confirm it with your DPO before you go further.
- 4
Score each risk to individuals, then assign a measure, an owner and a date to each one.
- 5
Delete the guide page, then share the document with your DPO or present it to management.
What you need
Requirements
- A Google account with access to Google Drive
Works with
- Google Docs
- Microsoft Word (download the .docx)
Questions
Is this a legal opinion or a finished assessment?
No. It is a structure to complete with your DPO and counsel. It does not state that any processing is lawful, so have it checked before you rely on it.
Are the organisation, people and figures real?
No. Willowmere Systems, its people, its clinics and its figures are fictional sample data. Replace every figure with your own before you use the document.
When should the assessment be completed?
Before launch, while the design can still change. An assessment written after go-live records a decision that has already been made, which regulators do not accept.
- #dpia-template
- #data-protection-impact-assessment
- #gdpr-dpia-example
- #special-category-data
- #healthcare-data
- #dpo-advice
- #google-docs-template
Related templates
More Google Docs templatesMore developer workflows templates
Admin Training Deck
Slides + PowerPoint11 slides
Free
Agency Sprint Plan
Docs + Word7 pages
Free
