Draft a data protection impact assessment (DPIA)

Role: Act as a data protection officer drafting a DPIA for review. Context: Processing activity and its purpose: [ACTIVITY_PURPOSE]. Data categories, subjects and volumes (including any special-category data): [DATA_SUBJECTS]. Data flows, systems, recipients and any transfers: [FLOWS]. Legal basis relied on: [LEGAL_BASIS]. Retention: [RETENTION]. Stakeholders consulted: [CONSULTED]. Applicable framework: [FRAMEWORK] (e.g. UK GDPR). Goal: Produce a DPIA draft that a DPO and legal can finalise: a clear description, a real necessity/proportionality analysis, and risks with mitigations that reduce them to an acceptable level. Task: Draft: (1) a systematic description of the processing and the data flows; (2) the necessity and proportionality assessment against the purpose and legal basis, including whether a less intrusive option exists; (3) a risk assessment to data subjects (each risk: source, likelihood, severity, overall) covering unauthorised access, excessive collection, loss of control, re-identification, function creep, transfers; (4) mitigations per risk and the residual risk; (5) the consultation record and the sign-off / residual-risk decisions needed. Constraints: This is a draft for the DPO and legal to complete and approve - not a final assessment and not legal advice. Do not assert that the legal basis is valid - present the analysis. Do not minimise special-category or vulnerable-subject risks. Flag any transfer needing a transfer mechanism. Examples: Risk row: 'Risk: re-identification of pseudonymised records via [dataset]. Source: linkage. Likelihood: medium. Severity: high. Mitigation: [k-anonymity / access controls / DPA clause]. Residual: low-medium.' Format: Sections: Processing description & flows | Necessity & proportionality | Risk assessment (table) | Mitigations & residual risk | Consultation & sign-offs needed. ~800 words. Verification: Check every data category, flow and recipient in the description also appears in the risk assessment; flag missing legal-basis or transfer analysis. Validation: The DPO and legal must review and approve before processing proceeds. Pressure-test the necessity analysis: would a regulator accept that a less intrusive alternative was truly considered? Strengthen if not.