The d.pia.lab has submitted its contribution to the European Data Protection Board (EDPB) public consultation on the draft Data Protection Impact Assessment (DPIA) Template and Explainer. The consultation was launched by the EDPB on 14 April 2026 as part of an initiative to develop a common European methodology for conducting DPIAs under Article 35 GDPR. According to the EDPB, the template may serve as a common reference point for supervisory authorities across the European Union and could become the basis for greater harmonisation of DPIA practices.
Supporting a Common DPIA Methodology
The authors welcome the EDPB's efforts to create a common methodology for DPIAs and recognize the draft template as an important step towards more structured and consistent assessment practices across organisations and sectors. The contribution highlights several positive elements of the proposal, including its focus on the perspective of data subjects, its structured approach, and its potential to improve the quality of risk assessments conducted under the GDPR.
At the same time, the paper identifies opportunities to strengthen the methodology and enhance its usefulness for both practitioners and regulators. The authors emphasize that DPIAs should not become a mere compliance exercise, but rather serve as tools that support informed decision-making and the effective protection of fundamental rights.
Main Recommendations
The submission advances a number of recommendations for improving the draft template and explainer, including:
- stronger coordination between DPIAs and other accountability instruments under the GDPR, as well as impact assessment requirements under EU digital regulation, including the AI Act;
- greater conceptual clarity regarding the relationship between proportionality assessments and risk assessments;
- clearer definitions of key concepts through a dedicated glossary;
- more operational criteria for assessing risk severity, likelihood, risk acceptance, and less intrusive alternatives;
- stronger and more systematic involvement of data subjects throughout the assessment process;
- encouraging the publication of DPIA outcomes and the creation of publicly accessible repositories of DPIA results;
- improved guidance for situations where technologies or systems are deployed across multiple processing activities.
The contribution was prepared by members and associates of d.pia.lab:
Maciej Otmianowski, Alessandra Calvi, Simone Casiraghi, César Augusto Fontanillo López, Pia Groenewolt, Federica Paolucci, Natalia Ribeiro Lopes de Paulo, Ine van Zeeland, and Niels Van Dijk.
