Data protection impact assessment (DPIA) template
- Art. 22-23 FADP
- Art. 35-36 GDPR
- About 60 minutes
- Italiano · Deutsch · Français · English
In brief
The template for assessing, before starting processing that may involve a high risk, the risks to people and the measures to reduce them. It documents the decision to go ahead or not.
- Who it is for
- Internal use: the internal contact, management and, if there is one, the data protection advisor. It is shown to the authority if you consult it.
- To decide first
- Which processing you are assessing; then in the text you describe data and purposes, assess necessity and risks and state the measures and the risk that remains.
- Afterwards
- Have it approved before the processing starts, implement the planned measures and review it if the processing changes.
What it contains
- 1Purpose
- 2When the assessment is necessary
- 3Description of the processing
- 4Necessity and proportionality
- 5Risk assessment
- 6Plan of measures
- 7Opinion of the data protection advisor
- 8Residual risk and prior consultation of the authority
- 9Decision
- 10Review and retention
An excerpt
1. Purpose
The data protection impact assessment describes planned processing, assesses its risks for the data subjects and sets out the measures to reduce them. It must be carried out before the processing begins and updated when the processing changes.
Legal bases:
- Art. 22 and 23 FADP and Art. 14 of the Data Protection Ordinance;
- Art. 35 and 36 GDPR.
2. When the assessment is necessary
Under the FADP (Switzerland)
The assessment is mandatory when the processing may entail a high risk to the personality or fundamental rights of the data subjects (Art. 22 para. 1 FADP). The high risk results, in particular where new technologies are used, from the nature, extent, circumstances and purpose of the processing. It exists in particular in the case of:
- large-scale processing of sensitive personal data;
- systematic monitoring of extensive public areas.
The full text is generated on the platform, with your organisation's details already in place.
FADP and GDPR compared
| FADP (Switzerland) | GDPR (EU) | |
|---|---|---|
| When | If the processing may result in a high risk (Art. 22 FADP) | If it is likely to result in a high risk, and in the cases of Art. 35(3) and the authorities' lists |
| High residual risk | Consult the FDPIC, unless the data protection advisor has been consulted (Art. 23 FADP) | Consult the supervisory authority prior to processing (Art. 36 GDPR) |
| Retention | At least two years after the end of the processing (Art. 14 Data Protection Ordinance) | No fixed period |
The template adapts itself: it picks the paragraphs by the laws that apply to your organisation.
Related templates
- Template for notifying data subjects of a data security breach
- Internal form template for reporting a data security breach
- Template for notifying a data security breach to the authority
Related question: Is a data protection impact assessment (DPIA) required?
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.