Skip to main content

d.pia.lab Policy Brief #3: developing a template for a report from the data protection impact assessment process

  • September 18, 2020

[Publication] On 11 September 2020, the d.pia.lab (Brussels Laboratory for Privacy and Data Protection Impact Assessments) published their 3rd Policy Brief: "Data protection impact assessment in the European Union: developing a template for a report from the assessment process" (Policy Brief 1/2020), co-authored by Dariusz KlozaAlessandra CalviSimone CasiraghiSergi Vazquez MaymirNikolaos IoannidisAlessia Tanas and Niels Van Dijk.

In parallel to the present Policy Brief, the d.pia.lab offers an editable form to fill in the template.

We sincerely thank everybody who participated in the public consultation of the earlier draft, during the summer of 2020.

Abstract: This Policy Brief proposes a template for a report from a process of data protection impact assessment (DPIA) in the European Union (EU). Grounded in the previously elaborated framework (cf. Policy Brief No. 1/2017) and method for impact assessment (cf. Policy Brief No. 1/2019), the proposed template conforms to the requirements of Articles 35–36 of the General Data Protection Regulation (GDPR) and reflects best practices for impact assessment, offering at the same time five novel aspects. First, it aims at comprehensiveness to arrive at the most robust advice for decision making. Second, it aims at efficiency, that is, to produce effects with the least use of resources. Third, it aims at exploring and accommodating the perspectives of various stakeholders, although the perspective of individuals dominates; it, therefore, fosters fundamental rights thinking by, for example, requiring justification for each choice, hence going beyond a mere ‘tick-box’ exercise. Fourth, it aims at adhering to the legal design approach to guide the assessors in a practical, easy and intuitive manner throughout the 11-step assessment process, providing necessary explanations for each step, while being structured in expandable and modifiable tables and fields to fill in. Fifth, it assumes its lack of finality as it will need to be revised as experience with its use grows. The template is addressed predominantly to assessors entrusted by data controllers to perform the assessment process, yet it may also assist data protection authorities (DPA) in the EU to develop (tailored down) templates for DPIA for their own jurisdictions.