EU GDPR LIA Template

Open the LIA with a concrete processing activity, not a project name. The record should identify the controller, business owner, product or service, categories of personal data, categories of data subjects, recipients, retention position, related RoPA entry, and whether the activity includes children, special category data, criminal-offence data, systematic monitoring, profiling, or international transfers.

Use Article 6(1)(f) only when all three conditions are met for the specific purpose: a legitimate interest is pursued by the controller or a third party, the processing is necessary for that interest, and the data subject's interests or fundamental rights and freedoms do not override it. Article 6(1)(f) is neither a fallback nor a preferred basis. Public authorities cannot use it for processing carried out in the performance of their tasks.

An Article 6 basis does not by itself permit every data category or method. If the activity uses special category data, identify a separate Article 9(2) exception. If it uses criminal-conviction or offence data, verify Article 10 authority and safeguards. Also check sector rules, including applicable ePrivacy rules for electronic communications and direct marketing.

The purpose section should distinguish the reason for processing from the interest or benefit being pursued. Avoid broad labels such as fraud prevention, security, analytics, or product improvement unless the record explains the concrete outcome sought, whose interest it serves, and why that interest is lawful, specific, real, and present.

The necessity section should test whether the interest can reasonably be achieved just as effectively through a less intrusive method. Consider less personal data, fewer people, shorter retention, less intrusive matching, aggregation, anonymisation, pseudonymisation, or a different operational process. A convenient or useful method is not necessarily necessary.

Use the balancing section to compare the controller's or third party's interest with the likely impact on the people whose data is processed. Base it on the actual context rather than generic risk language.

Record facts that can change the outcome: the nature and source of the interest, the relationship with the data subject, the information already provided, whether the processing is reasonably expected in that context, the nature and volume of the data, the scale and frequency of processing, the data subject's vulnerability, and likely positive or negative consequences.

Safeguards may reduce an undue impact, but do not use safeguards to make an unlawful, speculative, or unnecessary interest pass. Record the balance before and after additional safeguards so the decision shows what each safeguard changes.

A pass should depend on concrete safeguards, not on optimistic wording. The template should list controls already implemented and controls required before launch, with owners and evidence links.

If processing relies on Article 6(1)(f), Articles 13 and 14 require the privacy information to identify the legitimate interests pursued. Article 21 also gives people a right to object on grounds relating to their particular situation. The controller must stop unless it demonstrates compelling legitimate grounds that override the person's interests, rights, and freedoms or grounds for establishing, exercising, or defending legal claims.

Direct marketing follows a stricter rule. If a person objects to processing for direct marketing, including related profiling, the personal data must no longer be processed for that purpose. Do not apply the compelling-grounds override to a direct-marketing objection.

The completed LIA should be understandable without reconstructing the project history. Store the assessment with the linked RoPA entry, privacy notice, data-flow diagram, vendor record, retention rule, product requirement, security-control evidence, objection-handling log, and approval trail.

Reopen the LIA before a material fact changes. Examples include a new purpose, new data category, new data-subject group, new recipient, new transfer, longer retention, new profiling logic, new monitoring scale, a child-facing use, a pattern of objections, or a DPIA finding that changes the risk picture. Also review it when evidence shows that assumptions about necessity, expectations, impacts, or safeguards were wrong.

Use the prompts below as the controlled record. Replace every bracketed prompt with a factual answer or mark it not applicable with a reason. Do not leave the decision implicit in email, meeting notes, a ticket status, or a privacy-notice draft.

A complete record should let a new reviewer reproduce the decision from the stated facts. Keep source links and evidence references stable, name the version of each input reviewed, and separate existing safeguards from launch conditions that still need implementation.