# DPIA preparation checklist

PrivacyBuilt Editorial

A working starting point for global organisations. Adapt to the processing, role and relevant law; this is educational guidance, not legal advice or a compliance determination.

- [ ] Define the proposed processing, its purpose and accountable owner.
- [ ] Map collection, use, storage, sharing and deletion.
- [ ] Record screening reasons under the relevant law and context.
- [ ] Document necessity, proportionality, alternatives and legal basis.
- [ ] Identify affected people, including vulnerable groups where relevant.
- [ ] Consult relevant stakeholders and specialists as appropriate.
- [ ] Describe potential harms to people, not only business risks.
- [ ] Assess likelihood and severity using a documented consistent scale.
- [ ] Record controls, residual risk and any required escalation or consultation.
- [ ] Assign approval and monitoring responsibilities and a review trigger.

## Review record

Owner:
Scope:
Evidence references:
Open questions:
Decision and conditions:
Next review:

Avoid entering personal data, credentials or confidential source material in public tools.