Universal Data Protection Impact Assessment
UNIVERSAL DATA PROTECTION IMPACT ASSESSMENT (DPIA)
Multi-Jurisdiction Compliance Framework
COVER PAGE
| Field | Details |
|---|---|
| Organization Name | [________________________________] |
| Organization Address | [________________________________] |
| Assessment Title | [________________________________] |
| Assessment Reference Number | DPIA-[____]-[________________________________] |
| Version Number | [____] |
| Assessment Date | [__/__/____] |
| Processing Activity Described | [________________________________] |
| Business Unit / Department | [________________________________] |
| Assessment Prepared By | [________________________________] |
| Title / Role | [________________________________] |
| Data Protection Officer (DPO) | [________________________________] |
| Chief Information Security Officer | [________________________________] |
| Legal Counsel Reviewer | [________________________________] |
| Executive Approver | [________________________________] |
| Approval Date | [__/__/____] |
| Next Scheduled Review Date | [__/__/____] |
Applicable Jurisdictions
Identify all jurisdictions whose privacy laws apply to this processing activity:
US State Comprehensive Privacy Laws (Check all that apply):
☐ California (CCPA/CPRA) — effective January 1, 2020/2023
☐ Virginia (VCDPA) — effective January 1, 2023
☐ Colorado (CPA) — effective July 1, 2023
☐ Connecticut (CTDPA) — effective July 1, 2023
☐ Utah (UCPA) — effective December 31, 2023
☐ Iowa (ICDPA) — effective January 1, 2025
☐ Delaware (DPDPA) — effective January 1, 2025
☐ Nebraska (NDPA) — effective January 1, 2025
☐ New Hampshire (NHPA) — effective January 1, 2025
☐ New Jersey (NJDPA) — effective January 15, 2025
☐ Tennessee (TIPA) — effective July 1, 2025
☐ Minnesota (MCDPA) — effective July 31, 2025
☐ Maryland (MODPA) — effective October 1, 2025
☐ Indiana (INCDPA) — effective January 1, 2026
☐ Kentucky (KCDPA) — effective January 1, 2026
☐ Rhode Island (RIDTPPA) — effective January 1, 2026
☐ Texas (TDPSA) — effective July 1, 2024
☐ Oregon (OCPA) — effective July 1, 2024
☐ Montana (MCDPA) — effective October 1, 2024
International Laws:
☐ EU GDPR (Regulation (EU) 2016/679)
☐ UK GDPR (UK Data Protection Act 2018)
☐ Canada (PIPEDA / Provincial Laws)
☐ Other: [________________________________]
Federal Sector-Specific Laws:
☐ HIPAA (Health Insurance Portability and Accountability Act)
☐ GLBA (Gramm-Leach-Bliley Act)
☐ FERPA (Family Educational Rights and Privacy Act)
☐ COPPA (Children's Online Privacy Protection Act)
☐ FCRA (Fair Credit Reporting Act)
☐ Other: [________________________________]
Document Classification
☐ Confidential — Attorney-Client Privileged
☐ Confidential — Internal Use Only
☐ Restricted Distribution
☐ Other: [________________________________]
Privilege Note: Most state privacy laws provide that data protection assessments disclosed to the Attorney General during investigation are confidential and do not waive attorney-client privilege or work-product protections. Consult counsel for jurisdiction-specific protections.
EXECUTIVE SUMMARY
Overview of Processing Activity
[________________________________]
Provide a concise description of the data processing activity, its business purpose, scope, categories of consumers affected, and the nature of personal data involved.
Overall Risk Level
☐ Low Risk — Processing presents minimal risk across all applicable jurisdictions
☐ Moderate Risk — Processing presents some risk requiring standard mitigation
☐ High Risk — Processing presents heightened risk requiring enhanced safeguards
☐ Critical Risk — Processing presents severe risk; recommend cessation or redesign
Summary of Key Findings
[________________________________]
Recommendation
☐ Approve processing as described with current safeguards
☐ Approve subject to implementation of recommended mitigations
☐ Defer approval pending further analysis
☐ Do not approve — risks outweigh benefits
Multi-State DPIA Trigger Matrix
| Trigger Activity | CA | VA | CO | CT | TX | OR | NH | NJ | IN | RI | Other |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Targeted advertising | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Sale of personal data | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Profiling (heightened risk) | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Sensitive data processing | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Other heightened risk | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
SECTION 1: PROCESSING ACTIVITY DESCRIPTION
1.1 Nature of Processing
| Data Category | Description | Example Data Elements |
|---|---|---|
| Contact Information | [________________________________] | [________________________________] |
| Identity Data | [________________________________] | [________________________________] |
| Financial Data | [________________________________] | [________________________________] |
| Location Data | [________________________________] | [________________________________] |
| Biometric Data | [________________________________] | [________________________________] |
| Health Data | [________________________________] | [________________________________] |
| Online Activity / Browsing | [________________________________] | [________________________________] |
| Employment Data | [________________________________] | [________________________________] |
| Education Data | [________________________________] | [________________________________] |
| Inferences / Profiles | [________________________________] | [________________________________] |
| Other | [________________________________] | [________________________________] |
1.2 Whose Data Is Processed?
☐ Consumers / residents (specify states): [________________________________]
☐ Employees / job applicants
☐ Customers / clients
☐ Website visitors / app users
☐ Vendors / contractors
☐ Minors (under 13)
☐ Minors (13-17)
☐ EU/EEA data subjects
☐ Other: [________________________________]
Estimated data subjects per jurisdiction:
| Jurisdiction | Estimated Count | Meets Threshold? |
|---|---|---|
| California | [________________________________] | ☐ Yes ☐ No |
| Virginia | [________________________________] | ☐ Yes ☐ No |
| Colorado | [________________________________] | ☐ Yes ☐ No |
| Connecticut | [________________________________] | ☐ Yes ☐ No |
| Texas | [________________________________] | ☐ Yes ☐ No |
| New Hampshire | [________________________________] | ☐ Yes ☐ No |
| New Jersey | [________________________________] | ☐ Yes ☐ No |
| Indiana | [________________________________] | ☐ Yes ☐ No |
| Rhode Island | [________________________________] | ☐ Yes ☐ No |
| [________________________________] | [________________________________] | ☐ Yes ☐ No |
1.3 Purpose of Processing
| Purpose | Description | Legal Justification (by jurisdiction) |
|---|---|---|
| [________________________________] | [________________________________] | [________________________________] |
| [________________________________] | [________________________________] | [________________________________] |
1.4 How Is Data Processed?
☐ Collection (direct from consumer)
☐ Collection (from third-party sources)
☐ Storage (electronic / physical)
☐ Analysis / profiling
☐ Automated decision-making
☐ Targeted advertising
☐ Sale to third parties
☐ Sharing with service providers
☐ Cross-border transfer (international)
☐ Interstate transfer
☐ Deletion / destruction
☐ Other: [________________________________]
1.5 Retention and Deletion
| Data Category | Retention Period | Justification | Deletion Method |
|---|---|---|---|
| [________________________________] | [________________________________] | [________________________________] | [________________________________] |
1.6 Data Storage
| System / Platform | Location | Cloud/On-Prem | Encryption |
|---|---|---|---|
| [________________________________] | [________________________________] | [________________________________] | [________________________________] |
SECTION 2: LEGAL BASIS AND NECESSITY
2.1 Multi-Jurisdiction Lawful Basis Matrix
| Jurisdiction | Legal Basis | Consent Type | Notes |
|---|---|---|---|
| GDPR (if applicable) | ☐ Art. 6(1)(a) Consent ☐ Art. 6(1)(b) Contract ☐ Art. 6(1)(c) Legal Obligation ☐ Art. 6(1)(f) Legitimate Interests | ☐ Explicit ☐ Implied | [________________________________] |
| California (CCPA/CPRA) | ☐ Business purpose ☐ Consumer consent ☐ Legal obligation | ☐ Opt-in (sensitive) ☐ Opt-out (sale/share) | [________________________________] |
| Virginia | ☐ Consent ☐ Contract ☐ Legal obligation ☐ Legitimate interest | ☐ Opt-in (sensitive) | [________________________________] |
| Colorado | ☐ Consent ☐ Contract ☐ Legal obligation ☐ Legitimate interest | ☐ Opt-in (sensitive) | [________________________________] |
| Other states | [________________________________] | [________________________________] | [________________________________] |
2.2 Purpose Limitation
- Processing limited to disclosed purposes? ☐ Yes ☐ No
- Secondary uses disclosed? ☐ Yes ☐ No ☐ N/A
- Compatible with original collection context? ☐ Yes ☐ No
2.3 Data Minimization
- Minimum necessary data collected? ☐ Yes ☐ No
- De-identified data possible? ☐ Yes ☐ No
- Aggregated data possible? ☐ Yes ☐ No
- Formal minimization review conducted? ☐ Yes ☐ No
2.4 Multi-State Applicability Thresholds
| State | Threshold 1 | Threshold 2 | Revenue Minimum | Meets Threshold? |
|---|---|---|---|---|
| CA | $25M revenue OR 100K+ consumers/households OR 50%+ revenue from selling PI | N/A | $25M | ☐ Yes ☐ No |
| VA | 100,000+ consumers | 25,000+ consumers + >50% revenue from sale | None | ☐ Yes ☐ No |
| CO | 100,000+ consumers | 25,000+ consumers + revenue from sale | None | ☐ Yes ☐ No |
| CT | 100,000+ consumers (excl. payment-only) | 25,000+ consumers + >25% revenue from sale | None | ☐ Yes ☐ No |
| TX | Conducts business in TX AND is not a "small business" per SBA | N/A | None | ☐ Yes ☐ No |
| NH | 35,000+ consumers (excl. payment-only) | 10,000+ consumers + >25% revenue from sale | None | ☐ Yes ☐ No |
| NJ | 100,000+ consumers (excl. payment-only) | 25,000+ consumers + derives revenue from sale | None | ☐ Yes ☐ No |
| IN | 100,000+ consumers | 25,000+ consumers + >50% revenue from sale | None | ☐ Yes ☐ No |
| RI | 35,000+ consumers | 10,000+ consumers + >20% revenue from sale | None | ☐ Yes ☐ No |
SECTION 3: DATA INVENTORY
3.1 Categories of Personal Data
| Category | Collected? | Source | Recipients | Cross-Border? |
|---|---|---|---|---|
| Name / Contact | ☐ Yes ☐ No | [________________________________] | [________________________________] | ☐ Yes ☐ No |
| Government IDs | ☐ Yes ☐ No | [________________________________] | [________________________________] | ☐ Yes ☐ No |
| Financial / Payment | ☐ Yes ☐ No | [________________________________] | [________________________________] | ☐ Yes ☐ No |
| Geolocation | ☐ Yes ☐ No | [________________________________] | [________________________________] | ☐ Yes ☐ No |
| Biometric | ☐ Yes ☐ No | [________________________________] | [________________________________] | ☐ Yes ☐ No |
| Health / Medical | ☐ Yes ☐ No | [________________________________] | [________________________________] | ☐ Yes ☐ No |
| Online Activity | ☐ Yes ☐ No | [________________________________] | [________________________________] | ☐ Yes ☐ No |
| Inferences / Profiles | ☐ Yes ☐ No | [________________________________] | [________________________________] | ☐ Yes ☐ No |
3.2 Sensitive Data — Multi-State Comparison
| Category | CA | VA | CO | CT | TX | NH | NJ | IN | RI | Consent Required? |
|---|---|---|---|---|---|---|---|---|---|---|
| Racial/ethnic origin | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | Opt-in (all states) |
| Religious beliefs | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | Opt-in (all states) |
| Health diagnosis | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | Opt-in (all states) |
| Sexual orientation | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | Opt-in (all states) |
| Sex life | N/A | N/A | N/A | N/A | N/A | ☐ | N/A | N/A | N/A | Opt-in (NH only) |
| Citizenship/immigration | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | Opt-in (all states) |
| Genetic data | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | Opt-in (all states) |
| Biometric data | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | Opt-in (all states) |
| Children under 13 | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | Opt-in + COPPA |
| Children 13-15 (CA) | ☐ | N/A | N/A | N/A | N/A | N/A | N/A | N/A | N/A | Opt-in (CA only) |
| Precise geolocation | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | Opt-in (all states) |
Key Differences:
- NH uniquely includes "sex life" as a separate sensitive category and defines precise geolocation as within 1,750 feet
- CA treats data of children 13-15 as requiring opt-in for sale/sharing
- RI requires explicit consent with a mandatory 15-day suspension upon consent revocation
- CO requires universal opt-out mechanism recognition
3.3 Data Sources, Recipients, and Transfers
| Source/Recipient | Type | Purpose | DPA? | Transfer Tool |
|---|---|---|---|---|
| [________________________________] | ☐ Source ☐ Recipient | [________________________________] | ☐ Yes ☐ No | [________________________________] |
SECTION 4: STAKEHOLDER CONSULTATION
4.1 Data Subject Consultation
| Method | Date | Summary | Changes Made |
|---|---|---|---|
| [________________________________] | [__/__/____] | [________________________________] | [________________________________] |
4.2 DPO / Privacy Lead Input
| Name | Date | Recommendations |
|---|---|---|
| [________________________________] | [__/__/____] | [________________________________] |
4.3 Business and Legal Stakeholder Input
| Stakeholder | Date | Input |
|---|---|---|
| [________________________________] | [__/__/____] | [________________________________] |
SECTION 5: NECESSITY AND PROPORTIONALITY
5.1 Necessity Assessment
☐ Yes — processing is essential
☐ Partially — some elements could be reduced
☐ No — less intrusive alternatives exist
Explanation: [________________________________]
5.2 Less Intrusive Alternatives
| Alternative | Why Rejected or Adopted | Impact |
|---|---|---|
| [________________________________] | [________________________________] | [________________________________] |
5.3 Benefits vs. Risks
Benefits to Controller: [________________________________]
Benefits to Consumer: [________________________________]
Benefits to Public: [________________________________]
Risks to Consumer Rights: [________________________________]
Safeguards: [________________________________]
SECTION 6: RISK ASSESSMENT
6.1 Risk Matrix
| Likelihood / Severity | Negligible | Limited | Significant | Severe |
|---|---|---|---|---|
| Remote | Low | Low | Moderate | Moderate |
| Unlikely | Low | Moderate | Moderate | High |
| Possible | Moderate | Moderate | High | High |
| Likely | Moderate | High | High | Critical |
| Almost Certain | High | High | Critical | Critical |
6.2 Risk Register
| Risk ID | Description | Likelihood | Severity | Score | Jurisdictions Affected |
|---|---|---|---|---|---|
| R-001 | Unauthorized access / breach | ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain | ☐ Negligible ☐ Limited ☐ Significant ☐ Severe | [____] | [________________________________] |
| R-002 | Discriminatory profiling | ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain | ☐ Negligible ☐ Limited ☐ Significant ☐ Severe | [____] | [________________________________] |
| R-003 | Financial loss / fraud | ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain | ☐ Negligible ☐ Limited ☐ Significant ☐ Severe | [____] | [________________________________] |
| R-004 | Reputational harm | ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain | ☐ Negligible ☐ Limited ☐ Significant ☐ Severe | [____] | [________________________________] |
| R-005 | Sensitive data exposure | ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain | ☐ Negligible ☐ Limited ☐ Significant ☐ Severe | [____] | [________________________________] |
| R-006 | Re-identification | ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain | ☐ Negligible ☐ Limited ☐ Significant ☐ Severe | [____] | [________________________________] |
| R-007 | Cross-border transfer risk | ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain | ☐ Negligible ☐ Limited ☐ Significant ☐ Severe | [____] | [________________________________] |
| R-008 | Purpose creep | ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain | ☐ Negligible ☐ Limited ☐ Significant ☐ Severe | [____] | [________________________________] |
| R-009 | [________________________________] | ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain | ☐ Negligible ☐ Limited ☐ Significant ☐ Severe | [____] | [________________________________] |
6.3 Overall Risk Rating
☐ Low ☐ Moderate ☐ High ☐ Critical
SECTION 7: RISK MITIGATION MEASURES
7.1 Technical Measures
| Measure | Status | Owner | Target Date |
|---|---|---|---|
| Encryption at rest | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Encryption in transit | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| RBAC | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| MFA | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Pseudonymization / tokenization | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Audit logging | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| DLP | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Network segmentation | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Vulnerability management | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Retention enforcement | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Backup / DR | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
7.2 Organizational Measures
| Measure | Status | Owner | Target Date |
|---|---|---|---|
| Privacy training | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Security policies | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Incident response (multi-state) | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Privacy-by-design | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Consumer rights procedures | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Data mapping / ROPA | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Access reviews | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
7.3 Contractual Measures
| Measure | Status | Owner | Target Date |
|---|---|---|---|
| DPAs with all processors | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Vendor security program | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| SCCs / TIAs (international) | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Subprocessor restrictions | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
| Breach cooperation clauses | ☐ Implemented ☐ Planned ☐ N/A | [________________________________] | [__/__/____] |
7.4 Residual Risk
| Risk ID | Original | Mitigation | Residual | Acceptable? |
|---|---|---|---|---|
| R-001 | [____] | [________________________________] | [____] | ☐ Yes ☐ No |
| R-002 | [____] | [________________________________] | [____] | ☐ Yes ☐ No |
| R-003 | [____] | [________________________________] | [____] | ☐ Yes ☐ No |
SECTION 8: MULTI-STATE COMPLIANCE CHECKLIST
8.1 Consumer Rights Compliance Matrix
| Right | CA | VA | CO | CT | TX | NH | NJ | IN | RI |
|---|---|---|---|---|---|---|---|---|---|
| Right to know/access | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Right to correct | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Right to delete | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Right to portability | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Right to opt out (sale) | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Right to opt out (targeted ads) | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Right to opt out (profiling) | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Right to appeal | N/A | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
| Non-discrimination | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ | ☐ |
8.2 Response Timelines
| State | Response Deadline | Extension | Notes |
|---|---|---|---|
| CA | 45 days | + 45 days | Must verify identity |
| VA | 45 days | + 45 days | |
| CO | 45 days | + 45 days | Universal opt-out required |
| CT | 45 days | + 45 days | Universal opt-out required |
| TX | 45 days | + 45 days | |
| NH | 45 days | + 45 days | |
| NJ | 45 days | + extension | Universal opt-out required (eff. 7/15/2025) |
| IN | 45 days | + 45 days | |
| RI | 45 days | + 45 days | No universal opt-out |
8.3 Cure Period Comparison
| State | Cure Period | Sunset Date | Post-Sunset |
|---|---|---|---|
| CA | None | N/A | N/A |
| VA | 30 days (expired 1/1/2025) | 1/1/2025 | AG discretion |
| CO | 60 days (expired 1/1/2025) | 1/1/2025 | AG discretion |
| CT | 60 days (expired 12/31/2024) | 12/31/2024 | AG discretion |
| TX | 30 days (permanent) | No sunset | Always available |
| NH | 60 days (expired 12/31/2025) | 12/31/2025 | AG discretion |
| NJ | 18 months | 7/16/2026 | Division discretion |
| IN | 30 days (permanent) | No sunset | Always available |
| RI | None | N/A | Immediate enforcement |
8.4 Breach Notification Requirements Comparison
| State | Timeline | AG/Regulator Notice | CRA Notice Threshold | Notable |
|---|---|---|---|---|
| CA | Most expedient time, ≤ 72 hours (AG) | Yes (500+) | 500+ | Private right of action |
| VA | Without unreasonable delay | AG | 1,000+ | 60-day max |
| CO | 30 days | AG | 500+ | 30-day hard deadline |
| CT | 60 days | AG | 60 days | |
| TX | Individuals: without unreasonable delay, no later than 60 days after determination | AG: at least 250 Texas residents, electronic notice as soon as practicable/no later than 30 days | Nationwide CRAs: only if notice required at one time to more than 10,000 persons | |
| NH | ASAP | AG/regulator | 1,000+ | Private right of action |
| NJ | Most expedient time | State Police first | 1,000+ | Must notify SP before consumers |
| IN | ≤ 45 days | AG (45 days) | 1,000+ | Hard 45-day max |
| RI | 45 days (private) / 30 days (agency) | AG (500+) | 500+ | Detailed content requirements |
8.5 Universal Opt-Out Mechanism Requirements
| State | Universal Opt-Out Required? | Effective Date |
|---|---|---|
| CA | ☐ Yes | January 1, 2023 |
| CO | ☐ Yes | July 1, 2024 |
| CT | ☐ Yes | January 1, 2025 |
| TX | ☐ Yes | January 1, 2025 |
| MT | ☐ Yes | January 1, 2025 |
| NJ | ☐ Yes | July 15, 2025 |
| NH | ☐ No | N/A |
| IN | ☐ No | N/A |
| RI | ☐ No | N/A |
SECTION 9: THIRD-PARTY AND VENDOR ASSESSMENT
9.1 Sub-Processors
| Name | Services | Data | DPA? | Jurisdictions |
|---|---|---|---|---|
| [________________________________] | [________________________________] | [________________________________] | ☐ Yes ☐ No | [________________________________] |
9.2 Vendor Security Assessment
☐ SOC 2 Type II or equivalent
☐ Encryption standards verified
☐ Access controls reviewed
☐ Incident response confirmed
☐ Deletion / return procedures documented
☐ Subprocessor restrictions
☐ Insurance verified
☐ Multi-state breach cooperation clause
SECTION 10: AUTOMATED DECISION-MAKING AND PROFILING
10.1 Profiling Activities
- Involves profiling? ☐ Yes ☐ No
| Activity | Purpose | Data Used | Opt-Out? |
|---|---|---|---|
| [________________________________] | [________________________________] | [________________________________] | ☐ Yes ☐ No |
10.2 Automated Decision-Making
- Solely automated decisions with significant effects? ☐ Yes ☐ No
- Decision logic: [________________________________]
- Human review: [________________________________]
- Bias testing: ☐ Yes ☐ No
- Accuracy testing: ☐ Yes ☐ No
CA ADMT Note: California CPRA rulemaking imposes detailed obligations for Automated Decision-Making Technology (ADMT), including consumer access to information about ADMT logic and the right to opt out of certain ADMT decisions.
SECTION 11: CHILDREN'S DATA
11.1 Federal COPPA Compliance
- Data of known children under 13? ☐ Yes ☐ No
- Verifiable parental consent (COPPA)? ☐ Yes ☐ No ☐ N/A
- COPPA-compliant privacy policy? ☐ Yes ☐ No
- Age-gating? ☐ Yes ☐ No
11.2 State-Specific Children's Protections
| State | Requirement | Status |
|---|---|---|
| CA | Opt-in for sale/share of data of consumers 13-15 | ☐ Compliant ☐ N/A |
| CA | CA Age-Appropriate Design Code Act (CAADCA) for under-18 | ☐ Compliant ☐ N/A |
| All states | Under-13 data classified as sensitive (opt-in) | ☐ Compliant ☐ N/A |
| Federal | FTC COPPA enforcement | ☐ Compliant ☐ N/A |
SECTION 12: MONITORING AND REVIEW
12.1 Review Schedule
| Review Type | Frequency | Next Review | Responsible |
|---|---|---|---|
| Full DPIA | ☐ Annual ☐ Biannual ☐ Other | [__/__/____] | [________________________________] |
| Processing review | ☐ Quarterly ☐ Semi-annual ☐ Annual | [__/__/____] | [________________________________] |
| Mitigation effectiveness | ☐ Quarterly ☐ Semi-annual ☐ Annual | [__/__/____] | [________________________________] |
| Vendor review | ☐ Annual ☐ Biannual | [__/__/____] | [________________________________] |
| Regulatory landscape | ☐ Quarterly ☐ Semi-annual | [__/__/____] | [________________________________] |
12.2 Trigger Events
☐ Material change in processing
☐ New data categories or subjects
☐ New jurisdiction applicability
☐ New sub-processor or data recipient
☐ Security incident or breach
☐ Regulatory inquiry from any state AG
☐ Legislative changes in any applicable state
☐ Consumer complaints
☐ Organizational changes (M&A)
☐ Data volume change (> 25%)
☐ New state cure period expiration
12.3 Version Control
| Version | Date | Author | Changes |
|---|---|---|---|
| [____] | [__/__/____] | [________________________________] | [________________________________] |
SECTION 13: APPROVAL AND SIGN-OFF
Data Protection Officer
| Name | [________________________________] |
| Signature | [________________________________] |
| Date | [__/__/____] |
| Recommendation | ☐ Approve ☐ Approve with Conditions ☐ Reject |
CISO
| Name | [________________________________] |
| Signature | [________________________________] |
| Date | [__/__/____] |
| Recommendation | ☐ Approve ☐ Approve with Conditions ☐ Reject |
Legal Counsel
| Name | [________________________________] |
| Signature | [________________________________] |
| Date | [__/__/____] |
| Recommendation | ☐ Approve ☐ Approve with Conditions ☐ Reject |
Executive Approver
| Name | [________________________________] |
| Signature | [________________________________] |
| Date | [__/__/____] |
| Decision | ☐ Approved ☐ Approved with Conditions ☐ Rejected ☐ Deferred |
APPENDIX A: DATA FLOW DIAGRAM
[Data Subject] ---> [Collection Point] ---> [Primary Storage]
|
[Processing System]
|
+---------------+---------------+
| | |
[Analytics] [Third Party] [Backup/DR]
| | |
[Reporting] [Sub-Processor] [Archive]
Replace with actual data flow diagram.
APPENDIX B: RISK MATRIX
| Negligible | Limited | Significant | Severe | |
|---|---|---|---|---|
| Almost Certain | High | High | Critical | Critical |
| Likely | Moderate | High | High | Critical |
| Possible | Moderate | Moderate | High | High |
| Unlikely | Low | Moderate | Moderate | High |
| Remote | Low | Low | Moderate | Moderate |
APPENDIX C: GLOSSARY
| Term | Definition |
|---|---|
| DPIA | Data Protection Impact Assessment — a process to identify and mitigate privacy risks of data processing activities |
| Controller | Entity that determines the purpose and means of processing personal data |
| Processor | Entity that processes personal data on behalf of a controller |
| Personal Data | Information linked or reasonably linkable to an identified or identifiable individual |
| Sensitive Data | Categories of personal data requiring heightened consent protections (varies by state) |
| Sale | Exchange of personal data for monetary or other valuable consideration |
| Share (CA) | Cross-context behavioral advertising (CA-specific concept) |
| Targeted Advertising | Ads based on cross-site consumer activity data |
| Profiling | Automated processing to evaluate/predict personal aspects |
| Universal Opt-Out | Browser/device signal indicating consumer opt-out intent (GPC, etc.) |
| DPA | Data Processing Agreement between controller and processor |
| SCCs | Standard Contractual Clauses for international data transfers (EU) |
MULTI-STATE COMPLIANCE NOTES
Building a Multi-State DPIA Framework
-
Harmonize to the Highest Standard: Where state requirements conflict, design compliance to the most protective standard to ensure coverage across all applicable jurisdictions.
-
Sensitive Data — Use the Broadest Definition: Aggregate sensitive data categories from all applicable states. New Hampshire's nine categories (including sex life and 1,750-foot geolocation) are among the broadest.
-
Response Timelines — Use the Shortest Deadline: When operating across states, use the shortest applicable response timeline (generally 45 days) and the shortest extension period.
-
Breach Notification — Multi-State Playbook: Maintain a state-by-state breach notification matrix with jurisdiction-specific requirements for timing, AG/regulator notification, CRA notification thresholds, and content requirements.
-
Cure Period Awareness: Track cure period sunset dates and adjust compliance posture accordingly. As of 2026, only Texas and Indiana offer permanent cure periods.
-
Universal Opt-Out Compliance: Implement GPC/universal opt-out recognition where required (CA, CO, CT, TX, MT, NJ). Even where not required, consider implementation as a best practice.
-
DPIA Reuse: Most state laws allow a single DPIA to cover comparable processing operations and permit reuse of DPIAs conducted for other regulatory frameworks (GDPR, etc.) if scope and effect are comparable.
-
Privilege Protections: DPIAs are generally protected from public disclosure and do not waive privilege when disclosed to state AGs during investigations. Maintain privilege assertions on all DPIA documents.
SOURCES AND REFERENCES
- IAPP, US State Privacy Legislation Tracker — https://iapp.org/resources/article/us-state-privacy-legislation-tracker
- IAPP, "New Year, New Rules: US State Privacy Requirements Coming Online as 2026 Begins" — https://iapp.org/news/a/new-year-new-rules-us-state-privacy-requirements-coming-online-as-2026-begins
- Mayer Brown, "2025 Mid-Year Review: US State Comprehensive Data Privacy Law Updates" — https://www.mayerbrown.com/en/insights/publications/2025/09/2025-mid-year-review-us-state-comprehensive-data-privacy-law-updates-part-1
- Osano, "U.S. Data Privacy Laws: A Guide to the 2026 Landscape" — https://www.osano.com/us-data-privacy-laws
- MultiState, "All of the Comprehensive Privacy Laws That Take Effect in 2026" — https://www.multistate.us/insider/2026/2/4/all-of-the-comprehensive-privacy-laws-that-take-effect-in-2026
- Baker Donelson, "Privacy Laws Ring in the New Year: State Requirements Expand in 2026" — https://www.bakerdonelson.com/privacy-laws-ring-in-the-new-year-state-requirements-expand-across-the-us-in-2026
- Wiley, "Five Privacy Checkpoints to Start 2026" — https://www.wiley.law/alert-Five-Privacy-Checkpoints-to-Start-2026
- CompliancePoint, "State Privacy Laws Taking Effect in 2026" — https://www.compliancepoint.com/privacy/state-privacy-laws-taking-effect-in-2026/
- EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, Art. 35
- Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq.
About this template
- Last updated
- September 12, 2026
- Jurisdiction
- All states
- Category
- Compliance & Regulatory
Legal authority
- California Consumer Privacy Act (CCPA/CPRA), Cal. Civ. Code § 1798.100 et seq.
- Colorado Privacy Act (CPA), C.R.S. § 6-1-1301 et seq.
- Connecticut Data Privacy Act (CTDPA), Conn. Gen. Stat. § 42-515 et seq.
- Virginia Consumer Data Protection Act (VCDPA), Va. Code § 59.1-575 et seq.
- Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code § 541.001 et seq.
- Oregon Consumer Privacy Act (OCPA), ORS 646A.570 et seq.
- Montana Consumer Data Privacy Act (MCDPA), MCA § 30-14-2801 et seq.
- New Hampshire Privacy Act (NHPA), RSA 507-H
- New Jersey Data Privacy Act (NJDPA), N.J. Stat. § 56:8-166 et seq.
- Indiana Consumer Data Protection Act (INCDPA), IC 24-15
- Rhode Island DTPPA, R.I. Gen. Laws § 6-48.1
- EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, Art. 35
- Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq.
Compliance documents are what regulated businesses use to prove they follow the rules that apply to their industry, whether that is privacy, anti-money-laundering, consumer protection, or sector-specific requirements. Regulators look for consistent policies, up-to-date records, and clear evidence of employee training. The cost of getting compliance paperwork right is almost always smaller than the cost of an enforcement action, fine, or public disclosure.
Not legal advice
This template is provided for informational purposes. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.
Checked against the law it cites
The statutes this template relies on are listed under Legal authority.
Tex. Bus. & Com. Code § 521.053(b)-(c) (checked September 12, 2026): "A person who conducts business in this state and owns or licenses computerized data that includes sensitive personal information shall disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred, except as provided by Subsection (d) or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Any person who maintains computerized data that includes sensitive personal information not owned by the person shall notify the owner or license holder of the information of any breach of system security immediately after discovering the breach, if the sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person."
Tex. Bus. & Com. Code § 521.053(h)-(i) (checked September 12, 2026): "If a person is required by this section to notify at one time more than 10,000 persons of a breach of system security, the person shall also notify each consumer reporting agency, as defined by 15 U.S.C. Section 1681a, that maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notices. A person who is required to disclose or provide notification of a breach of system security under this section shall notify the attorney general of that breach as soon as practicable and not later than the 30th day after the date on which the person determines that the breach occurred if the breach involves at least 250 residents of this state."
Draft your Universal Data Protection Impact Assessment in the editor
Answer a few questions, let the AI editor draft each section from your answers, review it, and download Word and PDF. $99 one time, or $249 per month for every document and every Ezel app.