Skip to content
Privacy Practice LabLearn. Implement. Prove it.

Tools and templates

DPIA triage

Work out whether a planned processing activity needs a data protection impact assessment, and what the assessment should cover. Educational triage, not a legal determination.

This tool runs entirely in your browser. Your answers are not sent to us, stored, or associated with you in any way.

Used only to label your printed summary. It stays in your browser.

  1. Will the activity process personal data about a large number of people?

    Question 1 of 8

    Will the activity process personal data about a large number of people?

    Large is relative to your organisation and the context — a regional service reaching most of a population counts.

  2. Does it involve special-category, financial, children's or otherwise sensitive data?

    Question 2 of 8

    Does it involve special-category, financial, children's or otherwise sensitive data?

    Health, biometric, genetic, precise location, financial account data, or data about minors.

  3. Will decisions about individuals be made automatically or scored by a model?

    Question 3 of 8

    Will decisions about individuals be made automatically or scored by a model?

    Includes eligibility, pricing, fraud scoring, ranking of applicants and content moderation.

  4. Does it involve systematic monitoring, tracking or observation of people?

    Question 4 of 8

    Does it involve systematic monitoring, tracking or observation of people?

    Workplace monitoring, CCTV in public areas, behavioural tracking across services, proctoring.

  5. Does it use a technology that is new to your organisation, including AI features?

    Question 5 of 8

    Does it use a technology that is new to your organisation, including AI features?

    New in your context counts, not just new to the market.

  6. Are the individuals in a position of dependence or vulnerability relative to you?

    Question 6 of 8

    Are the individuals in a position of dependence or vulnerability relative to you?

    Employees, patients, students, benefit recipients, or people who cannot realistically object.

  7. Will datasets be combined, matched or enriched from separate sources?

    Question 7 of 8

    Will datasets be combined, matched or enriched from separate sources?

    Merging CRM with third-party enrichment, or joining operational and behavioural data.

  8. Will personal data be transferred to, or accessible from, another country?

    Question 8 of 8

    Will personal data be transferred to, or accessible from, another country?

    Includes remote support access from an offshore team and cloud regions outside your primary jurisdiction.

Answer all 8 questions to continue.

Privacy Practice Lab publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.

All tools and templatesTalk to the advisory team