A Data Protection Impact Assessment is required under Article 35 UK GDPR wherever processing is likely to result in a high risk to individuals. This free template gives you a working framework: the Article 35 threshold test, a full description of processing, the necessity and proportionality assessment, a 5×5 risk register, mitigations, residual risk and the Article 36 prior consultation gateway. It follows the ICO screening checklist and the EDPB nine criteria (WP248 rev.01, affirmed by EDPB Guidelines 3/2024). Download it, adapt it to your processing, and use it as the backbone of your DPIA record.
Get new data protection and digital regulation analysis by email.
What the template covers
The template runs the full Article 35 assessment in one document. It opens with the threshold test (Section 1), sets out the processing under Article 35(7)(a) (Section 2), works through necessity and proportionality under Article 35(7)(b) (Section 3), records consultation (Section 4), scores risks to individuals on a 5×5 matrix (Section 5), records mitigating measures under Article 35(7)(d) (Section 6), states residual risk and outcome (Section 7), and closes with the Article 36 prior consultation analysis (Section 8) and a DPO sign-off block (Section 9).
When you need a DPIA
A DPIA is mandatory under Article 35(3) for systematic and extensive profiling with significant effect, large-scale processing of special category or criminal offence data, and large-scale systematic monitoring of a public area. Beyond those triggers, the ICO screening checklist and the EDPB nine criteria identify further high-risk processing that requires one. For a full explanation of when a DPIA is required and how to carry one out, see our data protection practice page and the DPIA guidance.
How Bratby Law can help
Bratby Law advises controllers and processors on when a DPIA is required, how to score and mitigate risk, and whether Article 36 prior consultation is needed. For higher-risk processing, a template is a starting point, not a substitute for advice. Contact us to discuss your processing.
Rob Bratby, Managing Partner, Bratby Law. Last updated: July 2026.