EDPB Template for Data Protection Impact Assessment

What it is about

On 10 March 2026 the EDPB adopted version 1.0 of a common DPIA template with an explainer for public consultation. It was published on 14 April 2026, in line with the Helsinki statement to make GDPR compliance easier and more consistent. The consultation ran from 14 April to 9 June 2026 and is closed. After finalisation all national supervisory authorities will take steps to adopt the template as their sole template or as a meta-template to which national templates align. Use is not mandatory. As of 15 September 2026 no final version has been published.

What this means in practice

You can already compare your DPIA format with the EDPB template, so you can later align with what the Dutch DPA will use without rework. The template has a fixed structure: overview of the processing, systematic description, analysis (legal basis, minimisation, retention and measures), necessity and proportionality, risk assessment with an action plan, involvement of the DPO and data subjects, and conclusion. The final version and the date supervisory authorities will implement it are not yet known.

The GDPR articles concerned

• Article 35: Data protection impact assessment
• Article 36: Prior consultation