TEMPLATE FOR DATA PROTECTION IMPACT ASSESSMENT REPORT (DPIA) FOR PRIVATE SECTOR
This template is aimed at helping data controllers to comply with the provisions of the General Data Protection Regulation when it is necessary to carry out an Impact Assessment for Data Protection, within the framework of risk management for the rights and freedoms of individuals. 
Bearing in mind that this template is itself a working tool, the language used must be sufficiently clear and explanatory, and must be adapted to the audience to which it is oriented, so that there could be different versions of it. The recipients of the report may be persons who are legally or technically not used to the terminology of personal data protection. This is particularly relevant when the report is intended for managers who, based on it, must approve and apply the DPIA and, consequently, make decisions related to the processing of personal data analyzed in the DPIA, decisions that will affect the rights and freedoms of the natural persons whose data are going to be processed. 
This model contains the minimum chapters and sections that must appear in the documentation of a DPIA. Depending on its complexity, the content of the DPIA could be a single document or distributed in several documents. 
DPIA is a process within the framework of risk management. Therefore, completing this model should not be understood as the DPIA itself but a summary of the actions that the controller would have carried out following the recommendations indicated in the practical guide for Risk Management and Impact Assessment in the processing of personal data subject to the GDPR of the AEPD (hereinafter the GUIDE) and, in this way,  responding to the minimum requirements of the Instruction 1/2021 of the AEPD (hereinafter the Instruction), when a possible request for prior consultation to Control Authority is required by article 36.1 and, as indicated in recital 94 of the GDPR, where the controller considers that the risk cannot be mitigated by reasonable means. On the other hand, in order to be able to verify that the DPIA complies with the minimum formal requirements indicated in the Instruction, the checklist (hereinafter "the List") must be used. 

NOTE: These tables are intended to include a description of each section of the document. They do not replace the above-mentioned Guides and should be removed from the final report.

March 2022 version

I.	EXECUTIVE SUMMARY
This section should indicate the objectives pursued with the DPIA reflecting, in a condensed way, the most significant aspects of the chapters that are developed throughout the document.  In no case should the objectives of a DPIA be understood exclusively in terms of compliance but in terms of risk management for the protection of the rights and freedoms of natural persons.
This summary will contain the name of the processing and its version, the identification of the controller, the unit responsible in the organization, data management units that take part in any of the phases of the treatment, managers and sub-processors and planned data transfers.
In turn, it will include a brief description of the processing, its purpose, the main categories of data, significant processing operations and its planned implementation, as well as the conclusions of the analysis of necessity, suitability and proportionality of the processing and of the legal bases that legitimize the processing of the data.
Finally, it will include a brief description of the context of the DPIA and the formal risk management process, including a brief reference to the methodology used, the extent and limits of the DPIA, the most significant identified privacy risks, the management solutions and techniques planned, a synthesis of the cost-in-privacy analysis in relation to the benefit for data subjects and the conclusions derived from it. of the residual risk and the need to carry out or not a prior consultation.

II.	INDEX

I.	EXECUTIVE SUMMARY
II.	INDEX
III.	BASIC DATA
A.	Data controller identification
B.	Name and description of the processing
C.	Expected starting date of the processing
D.	Date of the end of the processing and expiration conditions
IV.	DPIA METHODOLOGY
A.	Persons involved in the implementation of the DPIA
B.	Guides, tools, methodologies, and standards used in the evaluation
C.	Extension and limits of the DPIA: Identify what has been left out of the evaluation
D.	Date of completion of the DPIA
V.	ANALYSIS ON THE LAWFULNESS OF THE PROCESSING
VI.	DESCRIPTION OF THE PROCESSING
A.	High level analysis of the processing
B.	Structured analysis of the processing
C.	Data lifecycle description
D.	Inventory of assets
E.	Cases of use
VII.	IDENTIFICATION AND ANALYSIS OF RISK FACTORS
A.	Identification of risk factors
B.	Analysis of risk factors
C.	Analysis of personal data breach scenarios
D.	Intrinsic risk assessment
VIII.	ANALYSIS OF DPIA OBLIGATION AND DPIA NEED
A.	Inclusion of the processing in the list of the types of data processing that do not require DPIA
B.	Analysis of the inclusion of the processing in the list of mandatory DPIA processing
IX.	risk reduction controls
A.	Measures on the design concept
B.	Governance measures and data protection policies
C.	Data protection measures by design
D.	Security measures and management of personal data breaches
E.	Risk reassessment
F.	Risk management action plan
X.	ANALYSIS OF THE NECESSITY AND PROPORTIONALITY OF THE PROCESSING
A.	Suitability judgment
B.	Judgment of necessity
C.	Proportionality judgment in the strict sense
XI.	NEED FOR PRIOR CONSULTATION
XII.	CONCLUSIONS AND RECOMMENDATIONS
XIII.	MEMORANDUM OF THE DATA PROTECCION OFFICER
A.	DPO point of view
B.	Conclusions and recommendations of the DPO to the controller
XIV.	REFERENCES
XV.	ANNEXES

III.	BASIC DATA
A.	Data controller identification
Identification of the GDPR controller entity, and if appropriate identification of joint controllers, as well as the rest of third parties involved in the processing with the unequivocal definition of their obligations and tasks.
Identification of the representative of the controller in case the controller is outside the European Union.
Identification of a point of contact (POC) in the controller/joint- controller entities (if possible DPO) as well as each of the controllers or POC for each of the management units or functional units involved in the processing. Where appropriate, include the date of notification of the DPO to the AEPD.
Details of the DPO's involvement in the DPIA in terms of advice, supervision, and enforcement.
Identification of the management unit or units in charge of the management of the processing within the controller organization.
B.	Name and description of the processing
Internal name given to the processing, given name in the  record of processing activities, and, if possible, identification of the version of the processing with indication of the history of changes and modifications made to the treatment, if any, in each of the stages of the same.
Brief description of the treatment, including the information established in article 31 of the LOPDGDD (30 of the RGPD) in relation to the record of processing activities.
C.	Expected starting date of the processing
This will include the estimated dates on which the processing is expected to begin.
Where the processing has been initiated prior to the DPIA and/or prior consultation and prior consultation is deemed necessary, an objectively reasoned justification shall be included explaining why the DPIA or prior consultation were not initially necessary and the reasons why they were subsequently deemed necessary, in accordance with section X.C of the GUIDE.
D.	Date of the end of the processing and expiration conditions
The date on which the processing is expected to end and/or the conditions of expiration of the processing will be included.
IV.	DPIA METHODOLOGY
A.	Persons involved in the implementation of the DPIA
In a brief way, description of the working group that has made this report and is involved in the management of risks to the rights and freedoms, detailing their roles, tasks, responsibilities, etc. In this section, a RACI matrix may be used.
If the views of data subjects or their representatives have been sought in the process of identifying and assessing the risks to the rights and freedoms, it should be included to describe their involvement in the DPIA process in line with Chapter XV of the GUIDE.
B.	Guides, tools, methodologies, and standards used in the evaluation
Guidelines, standards, and other reference materials used in the implementation of the DPIA shall be detailed. In particular, it will be detailed its adequacy to the provisions of Instruction 1/2021 in relation to Prior Consultations.
C.	Extension and limits of the DPIA: Identify what has been left out of the evaluation 
Identify the reasons why the scope of the DPIA is limited in relation to the purposes and scope of the processing, including those aspects that would be outside its analysis and the possible associated risks to the rights and freedoms of individuals, including the way in which they could be addressed and the identification of those responsible for such risks.
D.	Date of completion of the DPIA  
Date, time and identification of who coordinates the working group that carries out the DPIA on the realization of this report.
Version or review of the realization of the DPIA report and signature of the controller.
History of changes and modifications, in general any element that can demonstrate the follow-up carried out by the controller. 
V.	ANALYSIS ON THE LAWFULNESS OF THE PROCESSING  
This chapter develops the analysis of legal basis of the processing and, where appropriate, rules and other cases that legitimate the processing that is intended to be carried out.
We must be aware that regulatory compliance does not become part of the risk analysis, that compliance with principles and duties is mandatory.
The absence of a legal basis for the processing, or the existence of doubts about such legal basis, cannot be solved by the adoption of guarantees derived from risk management for citizens' rights and freedoms. 
In no case, the object of this document, is to justify the adoption of a specific legal basis of the processing.
The analysis of each legal basis will be carried out in relation to each of the purposes of the treatment including secondary or subsequent purposes.
The analysis of the legal basis will have to be justified according to the conditions that are met in accordance with Article 6 of the GDPR.
In the event that special categories of data are processed (Article 9 GDPR and Article 9 LOPDGDD) the reasons that led to the lifting of the prohibition on processing special categories of data must be properly justified. If the lifting of the prohibition is carried out by consent, the conditions of that consent will have been analyzed.

To complete this section, it is recommended to consult the Regulatory Compliance List published by the AEPD on its website.
VI.	DESCRIPTION OF THE PROCESSING 
A correct risk management for the rights and freedoms requires knowing the details of the processing which involves the necessary systematic description of it.
The best way to make the description of a processing is one that fits the description of processes are already used in the management and quality systems of the controller. The granularity that must be achieved in the description of the treatment must be sufficient to make it possible to carry out such management. In this sense, the processing could be studied in several levels of detail, for example:
• High-level study of processing.
• Structured analysis of the processing, or decomposition of the processing into phases to carry out the individual study of them.
• Data lifecycle analysis.
Finally, from the structured analysis of the processing it will be possible to obtain the inventory of assets associated to the processing activity according to the different cases of use to which the design of the same must respond. 
The description of the processing, irrespective of the method used, shall include at least:
• The type of agreement or legal act between joint controllers involved or third parties involved in the processing, as well as the legal act that links them to the processing and legitimates their participation in it and the link that specifies and defines the measures and guarantees of proactive responsibility that must be implemented by the data processor and sub-processors
• The existence of legal instruments to guarantee the consultation to the controller by the processor before addressing the contract to any other third-party.
• The measures provided to guarantee and demonstrate compliance with the provisions of the GDPR and the LOPDGDD, taking into account the obligations of information to the data subjects, the procedures to guarantee the rights of the data subjects.
• Planned data transfers and international data transfers.
• The codes of conduct, seals, trademarks and certifications that apply in each case.
Etc.
A.	High level analysis of the processing
If the description of the treatment is made through a high-level study, this section should include all relevant aspects of the processing analysis in a joint manner. 
At least, the high-level study of the treatment must include the information indicated in section V.A of the GUIDE in relation to the nature, purposes, scope and scope, and context of the treatment.
B.	Structured analysis of the processing 
If the description of the processing requires a greater degree of detail, it may be done by means of a structured analysis of the processing. This section will include the information of the study at the high level of the treatment and will identify the different treatment operations that are carried out in addition to the detail of the relationship between them taking into account the nature, purposes, scope, and context of the treatment. The degree of description of each operation will agree with the level of impact on the risk that each phase might have.
More detail on how to approach the structured analysis can be found in section V.B of the GUIDE.
C.	Data lifecycle description
Eventually, if a higher level of detail is required to carry out the systematic description of the treatment, it is advisable to carry out a global analysis of the data life cycle which will start from the structured analysis of the processing. 
Data life cycle analysis involves studying, for a given set or category of data, the different stages of its lifecycle, from its collection or generation to its destruction. The data lifecycle description is a complementary analysis to the high-level analysis and the structured analysis of the processing.
More detailed information can be found in section V.C of the GUIDE.
Likewise, it will be provided a description of third-party transfers, the recipients, and categories of recipients in relation to the purposes, the lifecycle of the processing itself, the life cycle of the data and the processing operations in addition to the functional description in which such data transfers to third parties are carried out for each of the recipients. The transfers of data will be linked to the legal bases that legitimize them.
D.	Inventory of assets
Based on the result of the structured analysis or the description of the life cycle of the data in the processing, it will be possible to obtain the list of all the assets necessary to address the initiation of the treatment and an adequate management of the risks to the rights and freedoms of natural persons.
Assets shall be included, organized and kept up to date, in what is called the processing asset inventory.  Assets are defined as any good or resource that may be necessary to implement and maintain a processing operation at any stage of its life cycle, from its conception and design to the withdrawal of treatment.
The level of detail to be included in the asset inventory should be necessary to identify and manage risks efficiently and, at the same time, to be able to demonstrate such management.
The inventory of assets must be determined from the structured analysis of the treatment, or through any other procedure determined by the entity, of equal or greater effectiveness.
Failure to have an adequate inventory of assets updated may involve inappropriate decision-making regarding the treatment and, in the case of carrying out a prior consultation, the Supervisory Authority may conclude that the information provided is incomplete, incorrect and, therefore, inaccurate, without prejudice of other principles such as transparency.
Section V.D of the GUIDE describes the information needed to document the assets of the treatment.
E.	Cases of use
Considering the complexity of the processing, there may be different cases of use in order to respond to different processes of an organization, in the description of the treatment in its different levels of detail, it must be identified to which case of use it refers and mark its differences. 
Likewise, the default privacy measures must be identified and documented, and their implementation must have been planned for each use case.
The identification of use cases, with examples, has been dealt with in the Default Data Protection Guide. And the List of Default Data Protection Measures also available online. 

VII.	IDENTIFICATION AND ANALYSIS OF RISK FACTORS  
The identification and analysis of risk factors for the rights and freedoms of natural persons is the prior step to the assessment of the level of inherent risks in the processing.
In the context of active responsibility, the identification and analysis of risk factors shall always be documented and justified so that the controller can demonstrate that the decisions taken at any given time in relation to risk management have been the most appropriate measures based on the information available ("accountability").
In order to support the performance of this task, the AEPD makes available to controllers and processors the GDPR Risk Assessment tool that aims to help managers and processors to identify the risk factors for the rights and freedoms of data subjects present in the processing,  making a first assessment of the intrinsic risk, helping to determine the obligation to carry out a DPIA, while it can also serve in the process of managing the residual risk of the processing.
In no case GDPR Risk Assessment represents the totality of the risk factors of the entire possible set of processing but a basis and methodology for the identification of the possible inherent risk factors of a processing and not a closed list of risk factors. It is up to the controller to identify all the possible risk factors that could affect the processing of personal data that is intended to be carried out in each case.
A.	Identification of risk factors
During risk management and analysis phases, in addition to risks included in GDPR, the LOPDGDD, sectorial regulations, lists, guides and guidelines approved by the data protection authorities, where a set of risk factors are identified; specific risk factors that derive from the intended processing of personal data must also be identified and evaluated according to their nature,  scope or the purposes pursued, without forgetting, either, those others that derive from the present context (internal and external to the organization) and future of the treatment.
Sections VI.C and VI.E of the GUIDE, provide lists of risk factors identified in the regulations are developed in more detail.
B.	Analysis of risk factors
For each identified risk factor, the controller must determine its inherent impact, that is, the potential results from not considering the measures and guarantees for rights and freedoms. The impact will depend on the damage that may be caused to the data subjects in particular and to society as a whole, within the scope of their rights and freedoms, in the short, medium and long term.
In turn, it will also be necessary to determine the probability that the identified risk will materialize.
Although the analysis can be done according to any recognized methodology, in section VI.B of the GUIDE a series of indications are given of how this analysis of the risk factors can be carried out in order to comply with the requirements of the Instruction. 
C.	Analysis of personal data breach scenarios 
In practice, the risk level assessment process cannot be carried out without taking into account the possible consequences of personal data breaches on data subjects in order to establish criteria for consistency in the risk assessment by preventing the initial risk assessment from differing in relation to the consequences on data subjects resulting from the loss of confidentiality, integrity, availability of data, reversal of anonymization/pseudonymization, use of data for non-compatible purposes, breach of warranties, etc.
Therefore, in the identification and analysis of risk factors, it is necessary to determine the damages that the materialization of personal data breaches that their different dimensions can have for data subjects.
Detailed guidance for the analysis of these damages in the event of personal data breaches is included in section VI.D of the GUIDE.
D.	Intrinsic risk assessment 
It is necessary to carry out an analysis of the total intrinsic risk of the processing, in accordance with Article 35.7.c of the GDPR, taking into account the elements identified from the result of the assessment of the level of risk for each of the risk factors identified in the processing.
The interdependence of different risk factors could increase the risk level of processing above the worst case of each risk factor taken individually.  When there are different risk factors, it is necessary to interpret how these factors, considered independently, could interact with each other to increase the level of risk of the processing (cumulative risk factor), by analyzing their combined dependencies and effects or the mutual interactions that exist between them.
Chapter VII of the GUIDE provides more detailed guidance for this assessment.

VIII.	ANALYSIS OF DPIA OBLIGATION AND DPIA NEED
A.	Inclusion of the processing in the list of the types of data processing that do not require DPIA 
If the processing is on the list of processing established within the framework of Article 35.5 of the GDPR, it is not mandatory to carry out the DPIA, and the report would end here, unless the controller has taken the decision to carry out the impact assessment, then the reasons should be motivated below (see sections XI and XII of the GUIDE).
This list, approved by the European Data Protection Board, can be consulted here and its nature is merely indicative.
B.	Analysis of the inclusion of the processing in the list of mandatory DPIA processing
This section will determine if there is an obligation to carry out the DPIA. This shall take into account, in particular, whether the processing:
1.	Is included in the list of cases listed in Article 35.3 of the GDPR.
2.	Is under the conditions detailed in the list, approved by the European Data Protection Board, of mandatory processing (article 35.4 of the RGPD) that can be consulted here taking into account that it is an indicative list of mandatory DPIA processing.
3.	There are the assumptions of greater risk of the cases listed in article 28.2 of the LOPDGDD.
It is recommended to make use of the GDPR Risk Assessment tool  for the analysis of the risk factors inherent in the processing that arises in the DPIA.
Regardless of all, data controller could assume the need to carry out the DPIA, in which case, the possible reasons that in the opinion of the controller would make the DPIA necessary must be indicated (data protection policies, quality requirements, etc.). 
IX.	risk reduction controls
The purpose of this section is to establish management measures, organizational measures, definition of processing, procedures and technical measures that allow managing each of the risk elements identified in section VII "Analysis of the obligation to carry out a DPIA: risk assessment"
More detailed information is available in Chapter VIII of the GUIDE
A.	Measures on the design concept  
These measures will act from the very definition of the nature, scope, context or purposes of the processing, that is, the essence of the processing as it is conceived and designed. 
On the original description of the treatment, it is necessary to optimize, from the point of view of data protection, the decomposition of this into phases or sub-processes, in order to be able to apply risk reduction measures with more granularity.
In this way, also identify possible unnecessary phases, isolate those with the highest level of risk from the rest of the phases, determine specific measures to manage the phases of greatest risk and determine those that do not require access to personal data.
Among the possible measures or guarantees that could be adopted would be those included in section VIII.A of the GUIDE. Also, for further guidance on this section it is advisable to consult the Default Data Protection Guide published by AEPD.
B.	Governance measures and data protection policies  
This section will indicate the governance measures and data protection policies of the entity (accountability) which are all those aimed at implementing a personal data governance system that allow demonstrating compliance with:
-Principles
-Rights
-Guarantees to manage risk.
In particular:
- Measures that allow to have control over what data are accessed, by whom, from whom, when, with what legitimacy and purpose, what treatments have been carried out on them
- Measures to ensure that rights management systems are properly implemented
- Measures to preserve the traceability of data communicated to third parties
- Appointment of DPO
- Measures to notify data subjects of security incidents affecting their rights and freedoms
- Human intervention by the controller in processing involving automated individual decisions
- etc.
Section VIII.B of the GUIDE shows a much more exhaustive list of examples of possible governance measures and data protection policies.
C.	Data protection measures by design
The applicable Privacy by Design and Default measures will depend on the type of processing. In addition, specific measures will be applied in the different phases of the processing, therefore, the application of these measures is related to the previous section of optimization of the processing.
To resolve this section, it is advisable to consult, in particular,  the Privacy from Design Guide published by the AEPD, and in general, the guides and notes published on the AEPD website in the Innovation and Technology section.
A list, for generic and non-exhaustive processing, is derived from the provisions of article 25 of the GDPR, and are measures that include minimization, concealment, separation, abstraction, information, control, compliance and demonstration, which can be found in summary form in section VIII.C of the GUIDE.
D.	Security measures and management of personal data breaches 
This section details the analysis of the necessary requirements to minimize risks to the rights and freedoms over security domains: confidentiality, availability, and integrity and how to integrate these requirements with the rest of the security requirements (for business continuity, fraud control, etc.) of the organization. 
In addition, the management of the entity will be specifically included in the event of personal data breaches.
It may be convenient to attach to the document the list of applicable measures signed by the security officer.
Detailed guidance on the applicable security measures for the protection of rights and freedoms can be found in section VIII.D of the GUIDE.
E.	Risk reassessment
Risk management is an iterative process, the application of a measure to mitigate or mitigate a risk can, in turn, cause the appearance of new risks or unintended consequences for stakeholders. A re-identification and risk reassessment must be carried out again after the implementation of the measures.
Residual risk shall be quantified in accordance with the organization’s risk management policy.
Chapter IX of the GUIDE contains guidance on this necessary re-evaluation in the impact assessment.
F.	Risk management action plan  
This section will detail the necessary actions to carry out the adequate risk management for the rights and freedoms of individuals, reflecting the set of actions necessary for the review and updating of the measures that would have been identified in the DPIA.
The action plan can be defined in data protection policies (Article 24 of the GDPR) if the controller deems it necessary, including in them, the clauses of expiration of the processing. 
Risk management action plan must detail the objectives, tasks, calendar, the necessary resources, those responsible, as well as the interaction with other treatments of the organization.
In particular, the privacy measures by design and by default that would have been defined in the DPIA must be reflected so that data protection is an integral to the product/service, not an added layer.

X.	ANALYSIS OF THE NECESSITY AND PROPORTIONALITY OF THE PROCESSING
One of the requirements of article 35 of the GDPR in relation to the DPIA is the one that appears in section 35.7.b of the GDPR, the obligation to carry out "an evaluation of the necessity and proportionality of the processing operations in terms of their purpose". The analysis of necessity and proportionality of the processing should not be confused with the analysis of the obligation or the need to carry out the DPIA.
The word "evaluate" involves the performance of an objective analysis that supports a conclusion, so it is not reduced to a simple statement.
This principle of proportionality, taken to the evaluation of the necessity and proportionality of the processing, translates into a weighting according to three judgement criteria:
-	Suitability judgment: It is necessary to determine if the processing is suitable for the purpose it pursues. The processing responds to certain shortcomings, demands, demands, obligations or objective opportunities and can achieve the proposed objectives with sufficient efficiency.
-	Judgment of necessity: It is necessary to determine whether the purpose pursued cannot be achieved in another less harmful or invasive way, that is, there is no alternative processing that is equally effective for the achievement of the purpose pursued.
-	Proportionality judgment in the strict sense: The seriousness of the risk to the rights and freedoms of the processing, and its interference in privacy, must be appropriate to the objective pursued and proportionate to the urgency and gravity of it. It is necessary to weigh the benefit that the treatment, from the point of view of data protection, provides to society while maintaining a balance with the impact it represents on other fundamental rights. However, even if it may partially affects fundamental rights, in no case, the absolute denial of the right to data protection can be assumed and emptied of its essential content.
This evaluation must end with a decision whether or not to carry out the processing, or where appropriate, modify it so that it complies with the three required judgments. In no case is it recommended to continue with the DPIA when the treatment does not reach the assessment of necessity and / or proportionality.
Non-compliance with these requirements cannot be addressed or justified by alternative forms of compliance, such as legal bases or technical and organizational measures.
Chapter XIII of the GUIDE contains detailed information on how to conduct these assessments.
A.	Suitability judgment
The threshold of effectiveness of the processing shall be defined. It will be established objectively or qualitatively and based on evidence, determining what is the threshold of effectiveness that should be reached to meet the purposes of the processing.
The effectiveness of the processing proposal will be evaluated. The effectiveness of the processing, as it has been proposed, will be assessed in an objective, qualitative and evidence-based way, verifying if it responds to the needs raised and extent.
B.	Judgment of necessity
The relevance of the purposes of the processing will be determined. It will be assessed that the purposes of the treatment are of sufficient importance to be addressed with a high-risk processing.
The adequacy of the processing operations will be verified, that is, that each of them is aimed at fulfilling the purposes of the processing in an objectively and demonstrable way.
The current configuration of the processing will be justified. It will be evaluated that there is no other processing, already in progress or that could be raised, that might resolve the declared purposes without involving a high risk, even if it is necessary to introduce some modification to fulfill the purposes pursued.
The limitation clauses provided for the processing will be indicated both by their nature, as well as by their scope, their context and their purposes.
C.	Proportionality judgment in the strict sense
It must be identified the degree of impact of the processing on the rights and freedoms. It is required to express, in detail, the limitations or intrusions to the rights and freedoms that the processing may entail for data subjects. This evaluation is a previous task that has already had to be carried out in the determination of the factors and levels of risk previously analyzed, exposing at this point of the evaluation its conclusions.
Compensatory measures shall be identified and described. Details of the controls established in the processing design are required to reduce this impact.
The benefits of the processing will also be identified. The advantages and benefits that the processing, objectively and with evidence, has for data subjects, considºered individually and collectively, must be determined. In other words, social benefit must also be considered.
The existence of identity in the quality of the information will be confirmed. It must be evaluated whether there is symmetry in the information analyzed for the weighting judgment, that is, if the level of analysis in relation to the impact is equal to the level reached based on the information provided regarding the advantages. 
A HBB (Harm-Benefit Balance) analysis will be performed. An assessment is required on whether the benefits to data subjects and society, previously determined, outweigh, and justify the impact on the rights and freedoms identified in the first point of this proportionality judgment in the strict sense.
XI.	NEED FOR PRIOR CONSULTATION
Based on the results obtained, it will be described whether or not it is necessary to carry out prior consultation with AEPD.
In the event that the residual risk is low, the possible prior consultation referred to in article 36 will not take place, if there are risks for which the controller could not have taken measures, then due request for prior consultation referred to in article 36 of the GDPR must be made in accordance with the requirements indicated in the Instruction. This section will detail the risks for which controller has not been able to adopt measures and which justify the need to carry out the request for prior consultation.
If a prior consultation on the same processing has been submitted in advance, it is necessary to details of all the modifications introduced in the nature, context, scope, purposes, risks and guarantees in the processing that could make the DPIA and prior consultation necessary. 
If there are prior consultations made to a Supervisory Authority in advance, an express reference to the response or responses of the Supervisory Authority or Authorities shall be included. 
The documentation included in prior consultation must guarantee that the information provided is complete and accurate (Art. 36.3 RGPD), the prior consultation will be signed by the controller of the processing and sent by the consultation channel of the AEPD as required by the Instruction. 
Further guidance can be found in Chapter XVI of the GUIDE.

XII.	CONCLUSIONS AND RECOMMENDATIONS
The working team carrying out the DPIA will reflect, in a condensed form, the final result of the risk management for rights and freedoms, the general guidelines for the implementation of the processing, it will also be determined that the risk is low enough and the following actions, in particular if the Prior Consultation to the AEPD is appropriate in accordance with Article 36 of the RGPD.
In short, the decision of the team that has made the DPIA must be indicated to the controller, including the points of view of its members.
XIII.	MEMORANDUM OF THE DATA PROTECCION OFFICER
A.	DPO point of view
This section will include in a condensed form, the point of view of the DPO in relation to the processing that is intended to be carried out, demonstrating its adequate participation in the DPIA process from the position and functions required by articles 38 and 39 of the GDPR to the controller and processor of the intended personal data processing. 
In general, the DPO must provide his opinion in relation to the possible risks to the rights and freedoms of natural persons, to the potential negative consequences that the treatment could involve for data subjects.
The opinion of the DPO should include its vision of the entire process in relation to the potential expectation of confidentiality of data subjects, avoiding that data subjects could carry out misinterpretations in relation to potential interference in their personal and family life.
B.	Conclusions and recommendations of the DPO to the controller
In an equally condensed or summarized manner, this section must include the conclusions and recommendations that, in its advisory work, the DPO makes to the controller or the processor of  the processing.
XIV.	REFERENCES
All documents that have been used in the implementation of the DPIA by the working group shall be detailed. 
It is not a question of supplementing this section with a list of documents that could have been used, but of reflecting throughout the DPIA reference to documents (opinions, judgments, legal reports, guides, normative references, etc.) on which the DPIA bases its conclusions, pointing out in this section an exhaustive list of the documents used. 
For example, referring to an information security management system, to a certain legal report or opinion that would not have been used in the DPIA, may involve providing incorrect information to the controller who will base his decisions on such incorrect information, and in the event that such information is provided to a Supervisory Authority it may be concluded that the information provided is incomplete,   incorrect and, therefore, inaccurate, without prejudice to the violation of other principles such as transparency.

XV.	ANNEXES
Any reference to working documents that may have been included in the DPIA that justify the decisions of the controller in relation to the processing and that, in addition, are part of the documents with which the controller can demonstrate compliance (assessment of the residual risk to rights and freedoms , contractual clauses, declarations, descriptions, reports, standards, guides or documents in general, inventory of assets, applicable security measures, etc.).

In................ to...... of................ 202x

	
Signature on behalf of the controller: 
Mr./Mrs.:
Charge:
Email: 
Telephone:

Signature of the Data Protection Officer (if applicable):
Mr./Mrs.:
Email: 
Telephone: