--- title: "DPIA for NGOs: how to do one, with a free DPIA template" description: "A practical guide to the data protection impact assessment (DPIA) for NGOs and humanitarian organisations, with a free template to download and fill in." url: https://reliefapplications.org/resources/dpia-for-ngos/ lang: en updated: 2026-11-11 --- # DPIA for NGOs: when you need one, how to do it, and a template A data protection impact assessment is how you find out, before you start, whether a new way of using people’s data could hurt them, and what you will do about it. This guide explains when the GDPR requires one, walks through the steps in the order the law sets them out, and comes with a template you can download. ## The short answer A DPIA is required before any processing that is likely to result in a high risk to people’s rights and freedoms, which in aid work includes registering vulnerable people, biometrics, case management and sharing data with donors. It describes the processing, tests whether it is necessary and proportionate, scores the risks to people and records the measures that reduce them. Do it before launch, not after. ## What a DPIA is, and is not Article 35 of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) makes the controller, which is your organisation, assess the effect of a planned processing on the protection of personal data when that processing is likely to result in a high risk. The result is a document, but the value is in the thinking: a DPIA is a process that starts when the project starts and carries on after it goes live. It is not a legal-basis memo and not a security checklist. It looks at risks to the people whose data you hold: discrimination, exclusion from aid, retaliation, loss of trust, physical danger. Humanitarian guidance, such as the [ICRC Handbook on Data Protection in Humanitarian Action](https://www.icrc.org/en/data-protection-humanitarian-action-handbook) and the IASC operational guidance on data responsibility, adds a second lens that fits aid work well: harm to groups and communities, and not only to individuals. ## When you need one Article 35(3) names three cases where a DPIA is always required: 1. A systematic and extensive evaluation of people based on automated processing, including profiling, that leads to decisions with legal or similarly significant effects. 2. Large-scale processing of special categories of data (health, ethnicity, religion, biometrics and so on) or of criminal convictions. 3. Systematic monitoring of a publicly accessible area on a large scale. Those are not the only cases. The European guidelines on DPIAs (WP248, endorsed by the European Data Protection Board) set out nine criteria. As a rule, processing that meets two or more of them needs a DPIA. National supervisory authorities also publish lists of processing that always needs one, and lists that never do. - **Evaluation or scoring**: Vulnerability scoring to decide who receives assistance - **Automated decisions with significant effect**: Eligibility decided by a rule or a model with no person in the loop - **Systematic monitoring**: Biometric checks at each distribution; location tracking; call-centre or hotline recording - **Sensitive data**: Health, protection case notes, ethnicity, religion, status as a refugee or a survivor - **Large scale**: A registration of thousands of people, or a regional programme - **Matching or combining datasets**: Merging registrations with a partner’s lists or a donor’s reporting data - **Vulnerable people**: Children, displaced people, survivors of violence, older people, people in conflict zones - **New technology**: A new app, biometrics, mobile money integrations, an AI assistant that reads case files - **Blocking access to a service or a right**: A registry that decides who can be assisted In humanitarian settings, most programmes hit at least two: vulnerable people and sensitive data. If you are unsure, do the assessment. The cost of an unneeded DPIA is a few hours. The cost of a missing one is a system built on a risk nobody examined. ## When you can skip one If the processing is clearly low risk, it is not likely to result in a high risk, or it is very similar to one you already assessed, you do not need a new DPIA. Keep a short note of why, so you can show your reasoning. A change to an existing system, such as a new data field or a new partner receiving data, may still call for the earlier assessment to be updated. ## The steps Article 35(7) sets the minimum content: a description of the processing, an assessment of necessity and proportionality, an assessment of the risks, and the measures to address them. The template follows the same order, with a step before and a step after. ### 1. Decide who does it, and involve the right people The controller is responsible, and the project owner usually leads. Ask your DPO for advice, as Article 35(2) requires, and record what they said. Bring in the people who know the system: programme, IT or security, and the field staff who will collect the data. Where it is appropriate, ask the people concerned, or their representatives, for their views (Article 35(9)). In humanitarian work, community feedback channels are the practical way to do it. ### 2. Describe the processing Say what you will do in plain terms: the purpose, what data, whose data, where it comes from, who sees it, where it is stored, who it is shared with, in which countries, and for how long. Draw the data flow, from collection to deletion. Most gaps show up here, because the people involved realise they describe the flow differently. ### 3. Test necessity and proportionality Ask whether you could reach the same goal with less data, or a less intrusive method. Check the legal basis, the data minimisation, how long you keep data, how people exercise their rights, and what you tell them. Humanitarian organisations often work under vital interests or a public-interest mandate rather than consent, because consent is hard to rely on when people depend on assistance. Say which basis you use and why. ### 4. Identify and score the risks For each risk, name the source, the threat, the harm to people and then score it. A simple grid works: how likely (remote, possible, likely) against how severe (minor, serious, severe), each scored 1 to 3. Multiply the two: 1 to 2 is low, 3 to 4 is medium, 6 to 9 is high. The risks that matter in aid work include: - Data reaching a party that could use it against the people concerned, such as an authority or an armed group. - People excluded or wrongly treated because of an error or a biased rule. - Re-identification of people from supposedly anonymous data, including small groups in small places. - Loss or theft of devices in the field. - Staff or partners copying data to their own tools. - People refusing help or hiding information because they do not trust the system. - Harm to a group, even when no single person can be identified. ### 5. Choose measures and record the residual risk For each risk above your tolerance, pick measures: collect less, mask or pseudonymise, restrict access by role, encrypt, separate sensitive data in its own store, shorten retention, set a data-sharing agreement, train the staff, test the system, add a way for people to object. Then score the risk again with the measures in place. That is the residual risk. ### 6. Decide, sign and consult if needed The project owner accepts the residual risk or sends the project back. The DPO’s advice goes on the record. If the residual risk is still high and you cannot reduce it, Article 36 requires you to consult the supervisory authority before you start. ### 7. Review Put a review date in the file and trigger a review whenever something changes: a new data field, a new partner, a new country, a new tool, a breach. ## A short worked example This example is invented to show the format. It is not a real project, and the scores are a judgement, not a rule. - **Processing**: Biometric (fingerprint) registration of households receiving cash assistance, checked at each monthly distribution. Data held by the NGO and shared in part with a payment provider. - **Necessity**: Goal: stop duplicate registration and fraud. Alternatives considered: ID cards and a photo, a household token. Fingerprints chosen only for sites without reliable ID documents. Not used where an ID is available. - **Risk 1**: Fingerprint data obtained by an authority and used to identify people. Likelihood: possible. Severity: severe. Score: high. - **Risk 2**: People without readable fingerprints excluded from assistance. Likelihood: likely. Severity: serious. Score: high. - **Measures**: Store only a template, not an image, and keep it on the device and in the NGO’s own store, never with the payment provider. A non-biometric fallback for anyone who cannot enrol or objects. Delete templates at programme close. Local data-sharing agreement. Staff trained. Complaints channel. - **Residual risk**: Risk 1: possible and serious, medium. Risk 2: remote, minor, low. - **Decision**: Go, with a review at six months. DPO advice recorded: keep the fallback visible at the distribution point. ## The template The RA DPIA template is a Word document of eight parts, in the order of this guide: 1. Project summary and who is involved 2. Is a DPIA needed? A screening checklist against the nine criteria 3. Description of the processing and its data flow 4. Necessity and proportionality 5. Risks to people, with a likelihood and severity grid 6. Measures and residual risk 7. DPO advice, views of the people concerned, and the decision 8. Review plan and change log Fill the screening part first. If the answer is no, you have your note of why. If it is yes, go on. The template is free to use and adapt inside your own organisation. It is a working tool and does not replace advice on a specific case. - [Download the DPIA template (Word)](https://reliefapplications.org/assets/downloads/RA-DPIA-template.docx): A Word document, eight parts, free to use and adapt. ## Mistakes we see - Doing it after launch, to file it. A DPIA that cannot change the design is paperwork. - Listing the legal basis and the security controls and calling it done, with no assessment of harm to people. - Leaving out the field team, who know how the data really moves. - Scoring everything medium so that nothing has to change. - No owner, no date and no review. - Treating a vendor’s own DPIA or security statement as yours. You can use it as an input. The assessment is about your use. ## How DP4G helps DP4G’s DPOs run and review DPIAs for humanitarian organisations. Our portal’s assistant drafts DPIAs, and a certified DPO reviews and signs each one. Ask us about [DP4G](https://reliefapplications.org/dp4g/), or start with the question that comes first: [does your NGO need a DPO?](https://reliefapplications.org/resources/does-an-ngo-need-a-dpo/) If you are choosing a new system, see our [ERP for NGOs buyer’s guide](https://reliefapplications.org/resources/erp-for-ngos/). ## Questions and answers ### Who is responsible for the DPIA? The controller, which is your organisation. In practice the project owner leads, the DPO advises, and management accepts or rejects the residual risk. ### DPIA or AIPD: is it the same thing? Yes. AIPD, analyse d’impact relative à la protection des données, is the French name of the DPIA. ### Do we need a DPIA for a system that already exists? The GDPR requires one before processing starts. For a system running without one, do it now: it is the sensible way to find out whether the system is safe, and supervisory authorities expect it. ### Do we have to publish the DPIA? No. The GDPR does not require publication. Publishing a summary can build trust with the people you serve, and some funders ask to see it. ### Does a vendor’s DPIA or security report replace ours? No. It describes their service in general. Your assessment covers what you do with it, with your data, in your context. ### How long does a DPIA take? A focused one for a well-defined system can take a few days, mostly spent gathering information from the people involved. Large or novel processing takes longer. Starting at design stage shortens it. ## Want a second pair of eyes on your DPIA? Send us the draft, or start with a free audit. A certified DPO reviews it and tells you what to change before you launch. - [Start your free audit](https://dpo.reliefapplications.org/signup/) ## Keep reading - [Does an NGO need a DPO?](https://reliefapplications.org/resources/does-an-ngo-need-a-dpo/): The DPO is the person who advises on your DPIA. - [ERP for NGOs: a buyer’s guide](https://reliefapplications.org/resources/erp-for-ngos/): Choosing a system that will hold staff and programme data. - [Privacy and cybersecurity services](https://reliefapplications.org/services/privacy-cybersecurity/): Audits, policies and security assessments. - [Case study: a data protection directive for child protection case management](https://reliefapplications.org/projects/tdh-developing-a-global-directive-for-data-protection-in-child-protection-case-management/): Work for Terre des hommes. This guide is general information based on Articles 35 and 36 of the GDPR and the European guidelines on DPIAs (WP248). It is not legal advice, and national supervisory authorities publish their own lists and templates. Reviewed on 11 November 2026 by the DP4G team at Relief Applications.