The ICO's DPIA Template (2026): How to Complete It, Step by Step

The ICO publishes a sample DPIA template for organisations working under UK GDPR. It is a short Word document with seven steps, from identifying the need for a DPIA to signing off the outcome, and each step lists the questions the ICO expects you to answer. The template provides the prompts, while the ICO's accompanying guidance explains what to consider when answering them.

The ICO says you do not have to use the template: "You can make your own to suit your needs, or use an existing project-management method, as long as it covers all the key elements of the process." When I checked the guidance on 10 November 2026, it carried a notice that it is under review because of changes made by the Data (Use and Access) Act.

Before you start: does the processing need a DPIA?

Step 1 of the template assumes you have already decided that a DPIA is needed. The ICO's guidance treats that decision as part of step 1: you check whether the processing appears on the ICO's list of types of processing that require a DPIA, and if it does not, you screen for other factors that indicate a likely high risk, such as processing the data of vulnerable people. If you screen and decide that no DPIA is needed, the ICO says you should record the decision and your reasons, including your DPO's advice where one is designated, and suggests that an annotated copy of its screening checklist is enough.

Our guide to whether an AI system needs a DPIA sets out the screening criteria in more detail.

Controller details

The first table asks for the name of the controller, the title of the DPO and the name of the contact or DPO. The controller is the organisation that decides why and how the personal data is used. A supplier is your processor where it processes personal data on your behalf and on your instructions. If it determines its own purposes, or jointly determines the purposes and means with you, for example by using your data to train its own models, assess whether it is an independent or joint controller for that processing.

Step 1: Identify the need for a DPIA

The template asks you to explain what the project aims to achieve, what type of processing it involves and why you identified the need for a DPIA.

A complete answer names the specific reason, not a general statement that personal data is involved. If the processing appears on the ICO's list, say which entry. If a combination of screening criteria led you there, name them: for example, systematic monitoring of employees combined with evaluation or scoring. Where any processing has already started, record what began and when. A later DPIA can assess existing processing, but it does not remedy a failure to carry out a required DPIA before that processing began.

Step 2: Describe the processing

This is the longest step, and the template divides it into four boxes: nature, scope, context and purposes. Describe the processing clearly enough to support the assessments of necessity, proportionality and risk.

Nature covers what you will do with the data: how you collect, use, store and delete it, where it comes from, who you share it with and which processors you use. The ICO suggests a flow diagram. You can also use a table showing each type of data, its source, its recipients and its retention period.

Scope covers what kinds of data are involved (including any special category or criminal offence data), how much, how often, how long it is kept, how many people are affected and the geographical area. Give numbers where you have them: "about 160 drivers" is more useful than "staff".

Context covers your relationship with the people affected, how much control they will have, whether they would expect the processing, whether they include children or other vulnerable groups, and any public concern about this kind of processing. This is where an imbalance of power belongs, for example between an employer and its staff, because it affects both the risks and the lawful basis.

Purposes covers what you want to achieve, the intended effect on individuals and the benefits, and each purpose should be listed separately. Make each purpose clear enough to assess its lawful basis and the necessity and proportionality of the processing for that use.

Step 3: Consultation process

The template asks when and how you will seek the views of the people affected, or why it is not appropriate to do so, and who else you need to involve: colleagues, processors, information security experts and others.

The ICO's guidance says you should seek and document individuals' views "unless there is a good reason not to", and that in most cases some form of consultation should be possible. If you decide not to consult, record the reason; the ICO gives commercial confidentiality, security, disproportionate effort and impracticability as examples. Your processors' contracts should require them to help, so ask them for the information you need about their part of the processing. Anyone responsible for information security should be consulted.

Step 4: Assess necessity and proportionality

The template asks for your lawful basis, whether the processing achieves your purpose, whether there is another way to achieve it, and how you will prevent function creep, ensure data quality and minimisation, inform individuals, support their rights, make sure processors comply and safeguard international transfers.

Answer the lawful basis question for each purpose listed at step 2. Where you rely on legitimate interests under Article 6(1)(f), record the interest, why the processing is necessary for it and whether the interests, rights or freedoms of the people affected override it, taking account of their reasonable expectations, and apply this assessment to each purpose. Explain whether a less intrusive approach could achieve the same purpose and, if you reject it, why. For transfers outside the UK, name the destination countries and the safeguard relied on for each.

Step 5: Identify and assess risks

The template asks you to describe the source of each risk and the nature of the potential impact on individuals, then score the likelihood of harm (remote, possible or probable), the severity of harm (minimal, significant or severe) and the overall risk (low, medium or high).

The risks are risks to the people whose data is used, not to your organisation. The template allows you to include associated compliance and corporate risks as well, but they do not replace the assessment of harm to individuals. The ICO's guidance lists the kinds of harm to consider, including inability to exercise rights, loss of control over personal data, discrimination, financial loss, identity theft or fraud, and re-identification of pseudonymised data, and it says the assessment should include security risks.

On scoring, the guidance says a harm "must be more than remote" to count as a risk, "but any significant possibility of very serious harm may still be enough to qualify as a high risk", and that "a high probability of widespread but more minor harm may still count as high risk". Record why you chose each score, so that someone reviewing the DPIA can follow the reasoning.

Step 6: Identify measures to reduce risk

For each risk scored medium or high at step 5, the template asks for the options to reduce or eliminate it, the effect on the risk (eliminated, reduced or accepted), the residual risk (low, medium or high) and whether the measure is approved.

Distinguish proposed measures from those approved for implementation. If a residual score depends on a measure a supplier has not yet confirmed, identify that dependency and keep the conclusion provisional. For processing already running, record the current risk separately from the expected risk after the planned measures are implemented.

Step 7: Sign off and record outcomes

The final table records who approved the measures, who approved the residual risks, the DPO's advice and whether it was followed, who reviewed the consultation responses, and who will keep the DPIA under review.

If your organisation has a data protection officer (DPO), you must seek their advice and record it (Article 35(2)). The template says the DPO should advise on compliance, the step 6 measures and whether the processing can proceed, and should also review ongoing compliance with the DPIA. If you have no DPO, record that in the relevant fields. The template's other notes set out what each row requires:

• the actions should be integrated back into the project plan, with a date and a person responsible;
• if any residual high risk remains, you must consult the ICO before going ahead;
• if the DPO's advice is overruled, you must explain your reasons;
• if your decision departs from individuals' views, you must explain your reasons.

The ICO's guidance adds that you do not always have to eliminate every risk, and that you may accept some risks, even a high risk, given the benefits of the processing. Where a high risk remains, though, you must consult the ICO before the processing begins. Set a review date and the triggers for an earlier review, such as a new purpose, a new supplier or a change in the data used.

Checks before sign-off

Check that step 2 identifies the data flows and processors, and that step 4 assesses the lawful basis for each purpose. Step 5 should assess harm to individuals, even where you also record corporate risks. Check that residual scores distinguish confirmed measures from proposals. Before sign-off, record the DPO's advice where one is designated and assign responsibility for completing the actions.

Using the template for an AI system

The template covers the same legal requirements for an AI system as for any other processing, but it does not prompt for the points specific to AI. Add them yourself: at step 2, whether the supplier may use your data to train or improve its models and what your contract says about it, and whether any decision about a person is made without meaningful human involvement; at step 5, the risk of inaccurate or biased outputs about people and of solely automated decisions with significant effects. Our guide to writing a DPIA for an AI system covers these in more detail, and our worked example shows a completed assessment for vehicle telematics with an AI driver score.

Our DPIA tool asks the questions in these steps in a conversation, screens first whether a DPIA is required, and drafts the document as you answer, in its own format. It is free to complete.

Sources

ICO, "Sample DPIA template" and "How do we do a DPIA?" (guidance on data protection impact assessments), both checked on 10 November 2026; UK GDPR, Articles 35 and 36; Article 29 Working Party, Guidelines on DPIA, WP248 rev.01.