Templates and records · ISO 27701 · Clause A.1

ISO 27701 privacy impact assessment template

The in-depth analysis carried out before high-risk processing begins: what will be done, whether it is necessary and proportionate, what could harm people and how that is prevented.

In one sentence

The privacy impact assessment describes the processing and its purposes, weighs its necessity and proportionality, analyses the risks to data subjects’ rights and freedoms and sets the measures to address them, which is the minimum content laid down in GDPR article 35(7); ISO/IEC 27701 includes it among the controller controls in table A.1.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27701 · Clause A.1 The 2025 edition is cited: numbers 4 to 10 are clauses; A.1, A.2 and A.3 are the Annex A tables with the controls for the controller, for the processor and common to both.
Type of information: Mandatory record A record to be retained when the processing calls for it (GDPR art. 35; table A.1 control)
Who fills it in: The controller, with the data protection officer The processor helps by providing whatever information it holds (GDPR art. 28(3)(f))
When: Before processing starts And again when the risk changes (GDPR art. 35(11))
How long it is kept: For as long as the processing continues Plus whatever period the organisation decides on afterwards, so it can show the assessment was done in time

What the standard requires

What ISO 27701 demands and what it leaves to your judgement

The standard asks the controller to assess the privacy impact when new processing or a change makes it necessary, and to retain the result. The GDPR makes it an obligation where a high risk to rights and freedoms is likely, citing systematic evaluation with legal effects, large-scale processing of special categories and large-scale systematic monitoring of publicly accessible areas.

Article 35(7) sets the minimum content and 35(2) requires the advice of the data protection officer, where one has been designated. If the residual risk is still high, the supervisory authority must be consulted before processing starts (art. 36).

Not being mandatory does not mean it cannot be done: many organisations apply a simplified version to any new processing, and it is wise to put in writing why a full assessment was judged unnecessary.

Read it in context: Controls for controllers and processors, in the ISO 27701 Academy

Structure

Fields the template should include

Systematic description of the processing and its purposes
Legitimate interest pursued, if that is the lawful basis
Assessment of necessity and proportionality
Risks to data subjects’ rights and freedoms
Measures envisaged: safeguards, security and protection mechanisms
Opinion of the data protection officer
Views of data subjects, if sought
Residual risk and decision: proceed, change or consult the authority
Date, approval and next review

Example

Example: biometric time recording at a fictitious plant

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Processing activity	Fingerprint time recording · Harbourside Foods (fictitious), 140 workers
Necessity	Compared with cards and a mobile app: both achieve the purpose without biometric data
Risks	Processing of special categories; irreversible leak of biometric templates
DPO opinion	Advises against fingerprints for lack of proportionality
Decision	Biometrics ruled out; card with PIN code introduced · 20 January 2026
Review	Whenever any change to the clock-in system is proposed

At the audit

Mistakes auditors commonly flag

The assessment is done after the tool has been bought and rolled out.
It is reduced to a security questionnaire with no analysis of necessity or proportionality.
The data protection officer’s opinion is not on record.
Nothing is written down to explain why a risky processing activity did not need a full assessment.

In Kimobox

How this record is kept in Kimobox

1Registering new processing goes through a workflow that asks whether an impact assessment is required.
2The assessment is documented as a form approved by the officer and by management.
3Agreed measures become actions with an owner, a date and an overdue alert.

Frequently asked questions

What people ask us before getting started

When is it mandatory?

When processing is likely to result in a high risk to individuals’ rights and freedoms (GDPR art. 35(1)). Supervisory authorities publish lists of processing operations that require one.

Does the processor carry it out?

No: the obligation lies with the controller. The processor helps with information about its means and measures.

Keep your ISO 27701 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring