# Draft a data protection impact assessment (DPIA)

A DPIA draft for a new system or process handling personal data.

- Topic: Legal & Compliance
- Framework: RCTFVV
- Level: Advanced
- Tags: Legal, Write, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/draft-a-data-protection-impact-assessment-dpia

## Prompt

```text
Role: Act as a data protection officer drafting a DPIA for review.

Context: Processing activity and its purpose: [ACTIVITY_PURPOSE]. Data categories, subjects and volumes (including any special-category data): [DATA_SUBJECTS]. Data flows, systems, recipients and any transfers: [FLOWS]. Legal basis relied on: [LEGAL_BASIS]. Retention: [RETENTION]. Stakeholders consulted: [CONSULTED]. Applicable framework: [FRAMEWORK] (e.g. UK GDPR).

Goal: Produce a DPIA draft that a DPO and legal can finalise: a clear description, a real necessity/proportionality analysis, and risks with mitigations that reduce them to an acceptable level.

Task: Draft: (1) a systematic description of the processing and the data flows; (2) the necessity and proportionality assessment against the purpose and legal basis, including whether a less intrusive option exists; (3) a risk assessment to data subjects (each risk: source, likelihood, severity, overall) covering unauthorised access, excessive collection, loss of control, re-identification, function creep, transfers; (4) mitigations per risk and the residual risk; (5) the consultation record and the sign-off / residual-risk decisions needed.

Constraints: This is a draft for the DPO and legal to complete and approve - not a final assessment and not legal advice. Do not assert that the legal basis is valid - present the analysis. Do not minimise special-category or vulnerable-subject risks. Flag any transfer needing a transfer mechanism.

Examples: Risk row: 'Risk: re-identification of pseudonymised records via [dataset]. Source: linkage. Likelihood: medium. Severity: high. Mitigation: [k-anonymity / access controls / DPA clause]. Residual: low-medium.'

Format: Sections: Processing description & flows | Necessity & proportionality | Risk assessment (table) | Mitigations & residual risk | Consultation & sign-offs needed. ~800 words.

Verification: Check every data category, flow and recipient in the description also appears in the risk assessment; flag missing legal-basis or transfer analysis.

Validation: The DPO and legal must review and approve before processing proceeds. Pressure-test the necessity analysis: would a regulator accept that a less intrusive alternative was truly considered? Strengthen if not.
```

## What to fill in

- ACTIVITY_PURPOSE
- DATA_SUBJECTS
- FLOWS
- LEGAL_BASIS
- RETENTION
- CONSULTED
- FRAMEWORK
- dataset
- k-anonymity / access controls / DPA clause

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.