DPIA template: privacy impact assessment

Screen a new project against the GDPR’s Art. 35 triggers, California’s risk-assessment rules and Virginia’s data protection assessment, then build the record each one asks for: the description, the necessity checks, a scored risk register, the sign-off and the review date. Print it or copy it. It runs in your browser and sends nothing.

Privacy impact assessment

GDPR data protection impact assessment; California risk assessment

Activity: Face-scan check-in at the turnstile
Business: Crux & Co. Climbing Gyms
Prepared by: Dana Whitfield, operations manager
Approved: 20 Oct 2026 by Maya Reyes, Chief executive
Next review: 20 Oct 2027

1.ScreeningArt. 35(1), (3); WP248; § 7150

Sensitive data or data of a highly personal nature (WP248 4)
Innovative use of new technology, such as face or fingerprint recognition for entry (WP248 8)
Processing sensitive personal information (other than employee data used only for pay, benefits, work authorisation, accommodation or wage reporting) (§ 7150(b)(2))

GDPR data protection impact assessment: expected: 2 of the 9 WP29 criteria; two or more call for a DPIA in most cases.
California risk assessment: required: § 7150(b)(2); conduct it before the processing starts (§ 7150(a)).

2.Description of the processingArt. 35(7)(a); § 7152(a)(1)–(3)

Purpose: Let members enter a gym by looking at the turnstile camera instead of carrying a key fob, so a lost or lent fob no longer lets a non-member in.
Legitimate interest: Not relied on: the lawful basis is the member's explicit consent.
Personal data: Face template (a numeric vector, not a photo)
Member ID
Check-in time and gym
Minimum needed: The template, member ID and check-in time. No photo is stored after enrolment; no camera footage is kept.
People: About 21,000 members across 9 gyms
Method and sources: Collected at the front desk when a member opts in; the template is matched on the turnstile unit in each gym.
Retention: Template: until the member opts out or cancels, deleted within 30 days. Check-in log: 13 months.
Interaction: In person at the front desk and the turnstile; members manage their choice in the gym app.
What people are told: Opt-in screen at enrolment, a sign at each turnstile, and the privacy policy's biometric section.
Recipients: Turnstile vendor (service provider / processor): hosts the matching software
Cloud host (sub-processor): encrypted backups only

3.Necessity, proportionality and benefitsArt. 35(7)(b); § 7152(a)(2), (4)

The purpose is specified, explicit and legitimate: yes: Entry control only; the contract with the vendor bars any other use.
A lawful basis is identified: yes: Explicit consent under Art. 9(2)(a); a fob or app QR code stays available at the same price.
Only the data the purpose needs is collected: yes: No photo kept after enrolment.
Each category has a retention period or criteria: yes: Deleted within 30 days of opt-out or cancellation.
People are told about the processing, and how: partly: Turnstile signs not yet printed.
Access, erasure and objection requests can be met: yes: Opt-out in the app deletes the template.
Vendors that touch the data are named and under contract: yes: Vendor DPA signed; one sub-processor listed.
Transfers outside the EEA have a transfer tool: partly: Vendor support team in the US: transfer tool to confirm.
Benefits: Members: no fob to forget or lose. Business: fob sharing ends and replacement fobs stop costing staff time.

4.Risks and the measures against themArt. 35(7)(c)–(d); § 7152(a)(5)–(6)

1.
Face templates stolen from the vendor's systems
Unauthorised access, use, change, loss or disclosure; before 2×4 high; after 1×4 medium
Cause: A breach at the turnstile vendor or its cloud host
Measures: Templates encrypted and kept on the gym's own turnstile unit; backups encrypted; vendor breach notice within 24 hours in the DPA.
2.
Members feel they have to enrol
Coerced into the processing; before 3×2 medium; after 1×2 low
Cause: Front-desk staff pushing the faster lane
Measures: Fob and app QR code kept at the same price; staff script says it is optional.
3.
Templates kept after a member leaves
Loss of control over their information; before 3×2 medium; after 1×2 low
Cause: Cancellation not passed to the turnstile system
Measures: Cancellation triggers deletion; monthly check of templates against active members.
4.
A member is wrongly refused at the turnstile
Psychological harm; before 2×1 low; after 2×1 low
Cause: A failed match in poor light or after a change in appearance
Measures: Staff override at the desk; member can re-enrol in a minute.
5.
Check-in data reused to track members
Loss of control over their information; before 2×3 medium; after 1×3 low
Cause: Someone wants usage reports per member
Measures: Check-in log limited to time and gym; the vendor contract bars other uses.

Risks by likelihood and severity, after the measures
Severity	Likelihood 1, remote	Likelihood 2, possible	Likelihood 3, likely	Likelihood 4, almost certain
4severe	medium: risk 1	high	high	high
3serious	low: risk 5	medium	high	high
2significant	low: risk 2, risk 3	medium	medium	high
1minor	low	low: risk 4	low	medium
	1remote	2possible	3likely	4almost certain

Severity 1 minor, 2 significant, 3 serious, 4 severe. Likelihood 1 remote, 2 possible, 3 likely, 4 almost certain.

severity up, likelihood acrosslowmediumhigh

5.ConsultationArt. 35(2), (9); § 7151; § 7152(a)(8)

DPO advice: No DPO designated; the Dublin gym's manager and outside counsel reviewed the draft.
Views of the people affected: Asked 40 members at two gyms; most wanted the fob kept as an option, which it is.
Information from: Dana Whitfield, operations manager
Sam Okafor, IT lead
Turnstile vendor's product team

6.Decision and sign-offArt. 36(1); § 7152(a)(7), (9); § 7155

Decision: Proceed once the listed measures are in place
Residual risk: medium at worst; 0 of 5 high after measures
Prior consultation: not indicated: no risk stays high
Keep until at least: 20 Oct 2031, or while the processing continues if later

Approved by

Date

Built with the OptOutDeck assessment template. A record of your own reasoning, not a finding of compliance; information, not legal advice.

Photocopy-style paste-up of a ruled grid of black bars with a magnifying glass, in a manila folder

What each law asks for

GDPR: when: before processing likely to result in a high risk, including three named cases; Art. 35(1), (3)
WP29 screening rule: two of the 9 criteria, in most cases; WP248
High risk left over: consult the supervisory authority first; Art. 36(1)
California: when: before any of six listed activities; § 7150
California: review: at least once every three years; within 45 calendar days of a material change; § 7155(a)
California: keep it: while the processing continues or five years after completion, whichever is later; § 7155(c)
California: existing processing: assess by 31 December 2027; submit by 1 April 2028; §§ 7155(b), 7157
Virginia: when: five kinds of processing; § 59.1-580(A)

GDPR, WP29 guidelines WP248 rev.01, CCPA regulations, Code of Virginia; read 22 Oct 2026. Information, not legal advice.

What a DPIA is, and when you need one

A data protection impact assessment (DPIA) is the written check a business runs before it starts processing that is likely to put people at high risk. GDPR Art. 35(1) says the controller “shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.” “Privacy impact assessment” is the older, general name for the same exercise.

US state laws ask for their own versions. California’s regulations call it a risk assessment and list six activities that need one; Virginia calls it a data protection assessment and lists five. The parts overlap enough that one record can serve all three: California lets a business reuse an assessment made for another law if it carries everything § 7152 asks for (§ 7156(b)), and Virginia accepts one with “reasonably comparable scope and effect” (§ 59.1-580(F)). Not sure which laws reach you? Run the which-laws-apply checker first.

What it does not do

It runs in your browser: nothing you type is sent to us or stored, and closing the tab clears it. It records your reasoning; it cannot tell you the processing is lawful. Information, not legal advice.

One record, three laws

Each part of the record above answers a line in each law. Where a law has no matching item, the part still belongs in a good assessment; it is simply not named there.

Where each part of the record sits in the GDPR, California's regulations and Virginia's statute
Part of the record	GDPR	California regs	Virginia
Screening	Art. 35(1), (3); WP248	§ 7150(b)	§ 59.1-580(A)
Description of the processing	Art. 35(7)(a)	§ 7152(a)(1)–(3)	context of the processing, § 59.1-580(C)
Necessity and proportionality	Art. 35(7)(b)	minimum data, § 7152(a)(2)	reasonable expectations, § 59.1-580(C)
Benefits	no separate item	§ 7152(a)(4)	§ 59.1-580(C)
Risks	Art. 35(7)(c)	§ 7152(a)(5)	§ 59.1-580(C)
Measures and safeguards	Art. 35(7)(d)	§ 7152(a)(6)	§ 59.1-580(C)
Who was consulted	Art. 35(2), (9)	§ 7151; § 7152(a)(8)	no separate item
Decision and sign-off	Art. 36(1) if high risk remains	§ 7152(a)(7), (9)	no separate item
Review	when the risk changes, Art. 35(11)	§ 7155(a)(2)–(3)	no cycle in § 59.1-580
GDPR Art. 35–36; Cal. Code Regs. tit. 11 §§ 7150–7157; Va. Code § 59.1-580; read 22 Oct 2026.

How to use this template

Screen. Tick the laws that reach you and every listed case that fits. The verdict per law tells you whether an assessment is required, expected, or your call.
Describe. Purpose, data, people, sources, retention and recipients. A current data map gives you most of it, and the retention periods can come straight from your retention schedule.
Weigh. Answer each necessity check yes, partly or no, with a note. A “no” is a finding, not a failure: it goes in the record as work to do.
Score the risks. One line per thing that could go wrong for the people, scored before and after the measures.
Sign off. Name who was consulted, record the decision and who approved it, and set the review date.
Print or copy. Print keeps only the record. Copy puts the same six parts on your clipboard for your own document system.

How the scoring works

Neither law fixes a scale. WP248 only asks that “likelihood and severity are estimated”, so this template uses four steps for each and multiplies them: 1 to 3 is low, 4 to 6 medium, 8 to 16 high. Measures usually lower the likelihood. They rarely lower the severity: a leaked face template cannot be reissued like a password, so that risk keeps its severity of 4 in the example even after the measures.

Worked example: face-scan entry at a climbing gym

The template opens on a fictional climbing-gym chain with gyms in California and Ireland (about 21,000 members across 9 gyms). It wants members to walk in by looking at a camera on the turnstile. A face template used to identify someone is special-category data under GDPR Art. 9(1) and sensitive personal information under Cal. Civ. Code § 1798.140(ae)(2)(A), so both laws engage. Under the GDPR the screening reads “expected”: two of the 9 WP29 criteria fit (sensitive data, and new technology used for entry, close to WP248’s own example of face and fingerprint recognition for access control). Under California’s regulations it reads “required”, because the chain processes sensitive personal information (§ 7150(b)(2)).

The example's risk register, before and after the measures
Risk	Kind of harm	Before	Main measure	After
Face templates stolen from the vendor's systems	Unauthorised access, use, change, loss or disclosure	2×4 high	Templates encrypted and kept on the gym's own turnstile unit	1×4 medium
Members feel they have to enrol	Coerced into the processing	3×2 medium	Fob and app QR code kept at the same price	1×2 low
Templates kept after a member leaves	Loss of control over their information	3×2 medium	Cancellation triggers deletion	1×2 low
A member is wrongly refused at the turnstile	Psychological harm	2×1 low	Staff override at the desk	2×1 low
Check-in data reused to track members	Loss of control over their information	2×3 medium	Check-in log limited to time and gym	1×3 low
Likelihood × severity, four-step scales; harms per regs § 7152(a)(5); read 22 Oct 2026.

Before the measures 1 of 5 risks score high; after them none does, and the worst left is medium. So no prior consultation is indicated under Art. 36(1). The chain still records “proceed once the listed measures are in place”, because two necessity checks are only partly met: the turnstile signs are not printed, and the vendor’s US support team needs a transfer tool. Approved on 20 Oct 2026, the record is due for review on 20 Oct 2027, is kept at least until 20 Oct 2031, and goes into the California submission due 1 Apr 2028.

Jurisdiction notes

EUCAVA

EU and EEA: the GDPR

Each supervisory authority publishes a list of processing that needs a DPIA (Art. 35(4)) and may publish one of processing that does not (Art. 35(5)); check your lead authority’s list before you rely on the screening alone. One DPIA may cover “a set of similar processing operations that present similar high risks” (Art. 35(1)). Where you have a data protection officer, their advice must be sought (Art. 35(2)). If a high risk remains after the measures, consult the authority before you start (Art. 36(1)); it has up to eight weeks to give written advice, extendable by six (Art. 36(2)). AI projects trip several WP29 criteria at once; the guide to GDPR-compliant AI covers the rest of what they need.

California: the CCPA regulations

The duty sits on businesses the CCPA covers, before they start one of the six activities in § 7150(b). Its stated goal is to restrict or stop processing whose risks to consumers outweigh its benefits (§ 7154). Each year’s assessments are reported to the Agency by 1 April of the next year, with an attestation signed under penalty of perjury by a member of executive management (§ 7157(b)(5), (c)). The CPRA guide explains where these rules came from.

Legal deadline

Processing that began before 1 January 2026 and continues after it must be assessed no later than 31 December 2027, and assessments made in 2026 and 2027 are submitted to the Agency by 1 April 2028 (§§ 7155(b), 7157(a)(1)).

Virginia and other states

The Attorney General can demand an assessment through a civil investigative demand; it stays confidential, is exempt from Virginia’s public-records law, and handing it over does not waive privilege (§ 59.1-580(D)). The duty covers processing created or generated after 1 January 2023 (§ 59.1-580(G)). The Virginia guide covers the rest of the act. Other states set their own assessment rules; this template follows Virginia’s text, so check the state’s own law before relying on it (state privacy laws compared).

Questions

Is a privacy impact assessment the same as a DPIA?

In practice, yes. “Privacy impact assessment” is the general term; “data protection impact assessment” is the GDPR’s (Art. 35). California’s regulations say “risk assessment” and Virginia’s statute “data protection assessment”. The required contents differ a little, which is why the record above cites each law part by part.

Does every new project need a DPIA?

No. The GDPR asks for one where processing is likely to result in a high risk (Art. 35(1)). WP248 adds that the risk-management duty remains for everything else, so keep the screening on file even when it comes out negative. The GDPR checklist shows where the DPIA sits among the other duties.

Do we have to publish it?

Not under the GDPR: WP248 says publishing is not a legal requirement, though a summary can build trust. California asks for summary information to be submitted to the Agency for each year in which assessments were made, not the full report (§ 7157(a)–(b)). Virginia keeps assessments confidential unless the Attorney General demands one (§ 59.1-580(D)).

Can one assessment cover several sites or similar projects?

Yes, where the processing is similar and so are the risks: GDPR Art. 35(1), California § 7156(a) (“a comparable set of processing activities”) and Virginia § 59.1-580(E) all allow it. The example covers every gym in the chain with one record.

Who should sign it off?

California requires the reviewer or approver to include someone with authority to decide whether the processing goes ahead, named with their position and the approval date (§ 7152(a)(9)). Under the GDPR the controller carries the duty (Art. 35(1)) and must seek the DPO’s advice where one is designated (Art. 35(2)).

What counts as a material change in California?

A change that creates new negative impacts, makes known ones likelier or larger, or weakens the safeguards (§ 7155(a)(3)). The regulation’s examples include a new purpose, a change in the minimum data needed, and many consumers complaining about the risks. The update is due within 45 calendar days of the change.