The European Data Protection Board (EDPB) has recently published a standardised template for conducting Data Protection Impact Assessments (DPIAs), accompanied by an explanatory guidance document. The template is open for public consultation until 9 June 2026 and represents a significant push toward greater harmonisation in the application of the General Data Protection Regulation (GDPR), particularly in relation to risk assessment, accountability obligations imposed on data controllers and processors, and demonstrating compliance.
A DPIA is a cornerstone requirement under Article 35 GDPR, designed to ensure that data processing activities are systematically evaluated prior to implementation. However, in practice, organisations have often faced inconsistencies in methodology, scope, and documentation standards resulting in a fragmented approach and uncertainty on whether one has complied with GDPR (and consequently the Data Protection Act, Chapter 586 of the laws of Malta). The
