{"answer_id":"praxikon:eu:gdpr:answer:dpia-inhoud","canonical_page":"https://www.praxikon.com/en/antwoord/avg/dpia-inhoud","query":"What must a DPIA contain at a minimum?","lang":"en","view":"full","mode":"gdpr","regime":"gdpr","topic":"dpia-inhoud","question":"What must a DPIA contain at a minimum?","label":"What a DPIA must contain","answer":"A DPIA contains at least (Article 35(7)): a systematic description of the envisaged processing operations and the purposes, including, where applicable, the legitimate interest pursued; an assessment of the necessity and proportionality of the processing in relation to the purposes; an assessment of the risks to the rights and freedoms of data subjects; and the measures envisaged to address those risks, including safeguards and security measures. The advice of the data protection officer is sought (Article 35(2)).","applied_to_question":null,"matched_terms":[],"articles":[{"article":35,"source_locator":"Art. 35(7)(a) to (d) GDPR","point":"The four mandatory elements.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/35"},{"article":35,"source_locator":"Art. 35(2) GDPR","point":"Advice of the data protection officer.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/35"}],"case_law":[],"guidance":[{"id":"wp29-wp248","kind":"guidance","title":"Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is \"likely to result in a high risk\" for the purposes of Regulation 2016/679","issuer":"Article 29 Working Party","reference":"WP248 rev.01","ecli":null,"date":"2017-10-04","status":"final","point":"DPIA guidelines with criteria for an acceptable DPIA (Annex 2).","source_url":"https://ec.europa.eu/newsroom/article29/items/611236","human_page":null},{"id":"gdpr-guidelines-dpia-template-2026","kind":"guidance","title":"EDPB Template for Data Protection Impact Assessment","issuer":"European Data Protection Board (EDPB)","reference":"EDPB Template [2026] for DPIA, versie 1.0 met explainer (aangenomen 10 maart 2026 voor publieke consultatie)","ecli":null,"date":"2026-04-14","status":"consultation","point":"EDPB template for a DPIA (consultation version).","source_url":"https://www.edpb.europa.eu/public-consultations/template-for-data-protection-impact-assessment_en","human_page":"https://www.praxikon.com/en/avg/richtsnoeren/dpia-template-2026"}],"enforcement":[],"open_questions":[],"human_page":"https://www.praxikon.com/en/avg/artikel/35","dataset":{"id":"praxikon-gdpr","source":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","known_at":"2026-09-15"},"casus_check":"https://www.praxikon.com/en/casus-check","disclaimer":"General interpretation, not legal advice. The official source remains authoritative.","methodology":"https://www.praxikon.com/en/methodologie"}