Templates Compliance Regulatory Universal Data Protection Impact Assessment
Universal
Compliance Regulatory
Blank Document PRO
From Template
Upload Document Word (.docx) & Markdown files
PRO
Universal Data Protection Impact Assessment
Ready to Edit

UNIVERSAL DATA PROTECTION IMPACT ASSESSMENT (DPIA)

Multi-Jurisdiction Compliance Framework

COVER PAGE

Field Details
Organization Name [________________________________]
Organization Address [________________________________]
Assessment Title [________________________________]
Assessment Reference Number DPIA-[____]-[________________________________]
Version Number [____]
Assessment Date [__/__/____]
Processing Activity Described [________________________________]
Business Unit / Department [________________________________]
Assessment Prepared By [________________________________]
Title / Role [________________________________]
Data Protection Officer (DPO) [________________________________]
Chief Information Security Officer [________________________________]
Legal Counsel Reviewer [________________________________]
Executive Approver [________________________________]
Approval Date [__/__/____]
Next Scheduled Review Date [__/__/____]

Applicable Jurisdictions

Identify all jurisdictions whose privacy laws apply to this processing activity:

US State Comprehensive Privacy Laws (Check all that apply):

☐ California (CCPA/CPRA) — effective January 1, 2020/2023
☐ Virginia (VCDPA) — effective January 1, 2023
☐ Colorado (CPA) — effective July 1, 2023
☐ Connecticut (CTDPA) — effective July 1, 2023
☐ Utah (UCPA) — effective December 31, 2023
☐ Iowa (ICDPA) — effective January 1, 2025
☐ Delaware (DPDPA) — effective January 1, 2025
☐ Nebraska (NDPA) — effective January 1, 2025
☐ New Hampshire (NHPA) — effective January 1, 2025
☐ New Jersey (NJDPA) — effective January 15, 2025
☐ Tennessee (TIPA) — effective July 1, 2025
☐ Minnesota (MCDPA) — effective July 31, 2025
☐ Maryland (MODPA) — effective October 1, 2025
☐ Indiana (INCDPA) — effective January 1, 2026
☐ Kentucky (KCDPA) — effective January 1, 2026
☐ Rhode Island (RIDTPPA) — effective January 1, 2026
☐ Texas (TDPSA) — effective July 1, 2024
☐ Oregon (OCPA) — effective July 1, 2024
☐ Montana (MCDPA) — effective October 1, 2024

International Laws:
☐ EU GDPR (Regulation (EU) 2016/679)
☐ UK GDPR (UK Data Protection Act 2018)
☐ Canada (PIPEDA / Provincial Laws)
☐ Other: [________________________________]

Federal Sector-Specific Laws:
☐ HIPAA (Health Insurance Portability and Accountability Act)
☐ GLBA (Gramm-Leach-Bliley Act)
☐ FERPA (Family Educational Rights and Privacy Act)
☐ COPPA (Children's Online Privacy Protection Act)
☐ FCRA (Fair Credit Reporting Act)
☐ Other: [________________________________]

Document Classification

☐ Confidential — Attorney-Client Privileged
☐ Confidential — Internal Use Only
☐ Restricted Distribution
☐ Other: [________________________________]

Privilege Note: Most state privacy laws provide that data protection assessments disclosed to the Attorney General during investigation are confidential and do not waive attorney-client privilege or work-product protections. Consult counsel for jurisdiction-specific protections.

EXECUTIVE SUMMARY

Overview of Processing Activity

[________________________________]

Provide a concise description of the data processing activity, its business purpose, scope, categories of consumers affected, and the nature of personal data involved.

Overall Risk Level

☐ Low Risk — Processing presents minimal risk across all applicable jurisdictions
☐ Moderate Risk — Processing presents some risk requiring standard mitigation
☐ High Risk — Processing presents heightened risk requiring enhanced safeguards
☐ Critical Risk — Processing presents severe risk; recommend cessation or redesign

Summary of Key Findings

[________________________________]

Recommendation

☐ Approve processing as described with current safeguards
☐ Approve subject to implementation of recommended mitigations
☐ Defer approval pending further analysis
☐ Do not approve — risks outweigh benefits

Multi-State DPIA Trigger Matrix

Trigger Activity CA VA CO CT TX OR NH NJ IN RI Other
Targeted advertising ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Sale of personal data ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Profiling (heightened risk) ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Sensitive data processing ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Other heightened risk ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐

SECTION 1: PROCESSING ACTIVITY DESCRIPTION

1.1 Nature of Processing

Data Category Description Example Data Elements
Contact Information [________________________________] [________________________________]
Identity Data [________________________________] [________________________________]
Financial Data [________________________________] [________________________________]
Location Data [________________________________] [________________________________]
Biometric Data [________________________________] [________________________________]
Health Data [________________________________] [________________________________]
Online Activity / Browsing [________________________________] [________________________________]
Employment Data [________________________________] [________________________________]
Education Data [________________________________] [________________________________]
Inferences / Profiles [________________________________] [________________________________]
Other [________________________________] [________________________________]

1.2 Whose Data Is Processed?

☐ Consumers / residents (specify states): [________________________________]
☐ Employees / job applicants
☐ Customers / clients
☐ Website visitors / app users
☐ Vendors / contractors
☐ Minors (under 13)
☐ Minors (13-17)
☐ EU/EEA data subjects
☐ Other: [________________________________]

Estimated data subjects per jurisdiction:

Jurisdiction Estimated Count Meets Threshold?
California [________________________________] ☐ Yes ☐ No
Virginia [________________________________] ☐ Yes ☐ No
Colorado [________________________________] ☐ Yes ☐ No
Connecticut [________________________________] ☐ Yes ☐ No
Texas [________________________________] ☐ Yes ☐ No
New Hampshire [________________________________] ☐ Yes ☐ No
New Jersey [________________________________] ☐ Yes ☐ No
Indiana [________________________________] ☐ Yes ☐ No
Rhode Island [________________________________] ☐ Yes ☐ No
[________________________________] [________________________________] ☐ Yes ☐ No

1.3 Purpose of Processing

Purpose Description Legal Justification (by jurisdiction)
[________________________________] [________________________________] [________________________________]
[________________________________] [________________________________] [________________________________]

1.4 How Is Data Processed?

☐ Collection (direct from consumer)
☐ Collection (from third-party sources)
☐ Storage (electronic / physical)
☐ Analysis / profiling
☐ Automated decision-making
☐ Targeted advertising
☐ Sale to third parties
☐ Sharing with service providers
☐ Cross-border transfer (international)
☐ Interstate transfer
☐ Deletion / destruction
☐ Other: [________________________________]

1.5 Retention and Deletion

Data Category Retention Period Justification Deletion Method
[________________________________] [________________________________] [________________________________] [________________________________]

1.6 Data Storage

System / Platform Location Cloud/On-Prem Encryption
[________________________________] [________________________________] [________________________________] [________________________________]

SECTION 2: LEGAL BASIS AND NECESSITY

2.1 Multi-Jurisdiction Lawful Basis Matrix

Jurisdiction Legal Basis Consent Type Notes
GDPR (if applicable) ☐ Art. 6(1)(a) Consent ☐ Art. 6(1)(b) Contract ☐ Art. 6(1)(c) Legal Obligation ☐ Art. 6(1)(f) Legitimate Interests ☐ Explicit ☐ Implied [________________________________]
California (CCPA/CPRA) ☐ Business purpose ☐ Consumer consent ☐ Legal obligation ☐ Opt-in (sensitive) ☐ Opt-out (sale/share) [________________________________]
Virginia ☐ Consent ☐ Contract ☐ Legal obligation ☐ Legitimate interest ☐ Opt-in (sensitive) [________________________________]
Colorado ☐ Consent ☐ Contract ☐ Legal obligation ☐ Legitimate interest ☐ Opt-in (sensitive) [________________________________]
Other states [________________________________] [________________________________] [________________________________]

2.2 Purpose Limitation

  • Processing limited to disclosed purposes? ☐ Yes ☐ No
  • Secondary uses disclosed? ☐ Yes ☐ No ☐ N/A
  • Compatible with original collection context? ☐ Yes ☐ No

2.3 Data Minimization

  • Minimum necessary data collected? ☐ Yes ☐ No
  • De-identified data possible? ☐ Yes ☐ No
  • Aggregated data possible? ☐ Yes ☐ No
  • Formal minimization review conducted? ☐ Yes ☐ No

2.4 Multi-State Applicability Thresholds

State Threshold 1 Threshold 2 Revenue Minimum Meets Threshold?
CA $25M revenue OR 100K+ consumers/households OR 50%+ revenue from selling PI N/A $25M ☐ Yes ☐ No
VA 100,000+ consumers 25,000+ consumers + >50% revenue from sale None ☐ Yes ☐ No
CO 100,000+ consumers 25,000+ consumers + revenue from sale None ☐ Yes ☐ No
CT 100,000+ consumers (excl. payment-only) 25,000+ consumers + >25% revenue from sale None ☐ Yes ☐ No
TX Conducts business in TX AND is not a "small business" per SBA N/A None ☐ Yes ☐ No
NH 35,000+ consumers (excl. payment-only) 10,000+ consumers + >25% revenue from sale None ☐ Yes ☐ No
NJ 100,000+ consumers (excl. payment-only) 25,000+ consumers + derives revenue from sale None ☐ Yes ☐ No
IN 100,000+ consumers 25,000+ consumers + >50% revenue from sale None ☐ Yes ☐ No
RI 35,000+ consumers 10,000+ consumers + >20% revenue from sale None ☐ Yes ☐ No

SECTION 3: DATA INVENTORY

3.1 Categories of Personal Data

Category Collected? Source Recipients Cross-Border?
Name / Contact ☐ Yes ☐ No [________________________________] [________________________________] ☐ Yes ☐ No
Government IDs ☐ Yes ☐ No [________________________________] [________________________________] ☐ Yes ☐ No
Financial / Payment ☐ Yes ☐ No [________________________________] [________________________________] ☐ Yes ☐ No
Geolocation ☐ Yes ☐ No [________________________________] [________________________________] ☐ Yes ☐ No
Biometric ☐ Yes ☐ No [________________________________] [________________________________] ☐ Yes ☐ No
Health / Medical ☐ Yes ☐ No [________________________________] [________________________________] ☐ Yes ☐ No
Online Activity ☐ Yes ☐ No [________________________________] [________________________________] ☐ Yes ☐ No
Inferences / Profiles ☐ Yes ☐ No [________________________________] [________________________________] ☐ Yes ☐ No

3.2 Sensitive Data — Multi-State Comparison

Category CA VA CO CT TX NH NJ IN RI Consent Required?
Racial/ethnic origin ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ Opt-in (all states)
Religious beliefs ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ Opt-in (all states)
Health diagnosis ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ Opt-in (all states)
Sexual orientation ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ Opt-in (all states)
Sex life N/A N/A N/A N/A N/A ☐ N/A N/A N/A Opt-in (NH only)
Citizenship/immigration ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ Opt-in (all states)
Genetic data ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ Opt-in (all states)
Biometric data ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ Opt-in (all states)
Children under 13 ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ Opt-in + COPPA
Children 13-15 (CA) ☐ N/A N/A N/A N/A N/A N/A N/A N/A Opt-in (CA only)
Precise geolocation ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ Opt-in (all states)

Key Differences:
- NH uniquely includes "sex life" as a separate sensitive category and defines precise geolocation as within 1,750 feet
- CA treats data of children 13-15 as requiring opt-in for sale/sharing
- RI requires explicit consent with a mandatory 15-day suspension upon consent revocation
- CO requires universal opt-out mechanism recognition

3.3 Data Sources, Recipients, and Transfers

Source/Recipient Type Purpose DPA? Transfer Tool
[________________________________] ☐ Source ☐ Recipient [________________________________] ☐ Yes ☐ No [________________________________]

SECTION 4: STAKEHOLDER CONSULTATION

4.1 Data Subject Consultation

Method Date Summary Changes Made
[________________________________] [__/__/____] [________________________________] [________________________________]

4.2 DPO / Privacy Lead Input

Name Date Recommendations
[________________________________] [__/__/____] [________________________________]

4.3 Business and Legal Stakeholder Input

Stakeholder Date Input
[________________________________] [__/__/____] [________________________________]

SECTION 5: NECESSITY AND PROPORTIONALITY

5.1 Necessity Assessment

☐ Yes — processing is essential
☐ Partially — some elements could be reduced
☐ No — less intrusive alternatives exist

Explanation: [________________________________]

5.2 Less Intrusive Alternatives

Alternative Why Rejected or Adopted Impact
[________________________________] [________________________________] [________________________________]

5.3 Benefits vs. Risks

Benefits to Controller: [________________________________]
Benefits to Consumer: [________________________________]
Benefits to Public: [________________________________]
Risks to Consumer Rights: [________________________________]
Safeguards: [________________________________]

SECTION 6: RISK ASSESSMENT

6.1 Risk Matrix

Likelihood / Severity Negligible Limited Significant Severe
Remote Low Low Moderate Moderate
Unlikely Low Moderate Moderate High
Possible Moderate Moderate High High
Likely Moderate High High Critical
Almost Certain High High Critical Critical

6.2 Risk Register

Risk ID Description Likelihood Severity Score Jurisdictions Affected
R-001 Unauthorized access / breach ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain ☐ Negligible ☐ Limited ☐ Significant ☐ Severe [____] [________________________________]
R-002 Discriminatory profiling ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain ☐ Negligible ☐ Limited ☐ Significant ☐ Severe [____] [________________________________]
R-003 Financial loss / fraud ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain ☐ Negligible ☐ Limited ☐ Significant ☐ Severe [____] [________________________________]
R-004 Reputational harm ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain ☐ Negligible ☐ Limited ☐ Significant ☐ Severe [____] [________________________________]
R-005 Sensitive data exposure ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain ☐ Negligible ☐ Limited ☐ Significant ☐ Severe [____] [________________________________]
R-006 Re-identification ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain ☐ Negligible ☐ Limited ☐ Significant ☐ Severe [____] [________________________________]
R-007 Cross-border transfer risk ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain ☐ Negligible ☐ Limited ☐ Significant ☐ Severe [____] [________________________________]
R-008 Purpose creep ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain ☐ Negligible ☐ Limited ☐ Significant ☐ Severe [____] [________________________________]
R-009 [________________________________] ☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain ☐ Negligible ☐ Limited ☐ Significant ☐ Severe [____] [________________________________]

6.3 Overall Risk Rating

☐ Low ☐ Moderate ☐ High ☐ Critical

SECTION 7: RISK MITIGATION MEASURES

7.1 Technical Measures

Measure Status Owner Target Date
Encryption at rest ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Encryption in transit ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
RBAC ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
MFA ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Pseudonymization / tokenization ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Audit logging ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
DLP ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Network segmentation ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Vulnerability management ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Retention enforcement ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Backup / DR ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]

7.2 Organizational Measures

Measure Status Owner Target Date
Privacy training ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Security policies ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Incident response (multi-state) ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Privacy-by-design ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Consumer rights procedures ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Data mapping / ROPA ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Access reviews ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]

7.3 Contractual Measures

Measure Status Owner Target Date
DPAs with all processors ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Vendor security program ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
SCCs / TIAs (international) ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Subprocessor restrictions ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]
Breach cooperation clauses ☐ Implemented ☐ Planned ☐ N/A [________________________________] [__/__/____]

7.4 Residual Risk

Risk ID Original Mitigation Residual Acceptable?
R-001 [____] [________________________________] [____] ☐ Yes ☐ No
R-002 [____] [________________________________] [____] ☐ Yes ☐ No
R-003 [____] [________________________________] [____] ☐ Yes ☐ No

SECTION 8: MULTI-STATE COMPLIANCE CHECKLIST

8.1 Consumer Rights Compliance Matrix

Right CA VA CO CT TX NH NJ IN RI
Right to know/access ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Right to correct ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Right to delete ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Right to portability ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Right to opt out (sale) ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Right to opt out (targeted ads) ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Right to opt out (profiling) ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Right to appeal N/A ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐
Non-discrimination ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐

8.2 Response Timelines

State Response Deadline Extension Notes
CA 45 days + 45 days Must verify identity
VA 45 days + 45 days
CO 45 days + 45 days Universal opt-out required
CT 45 days + 45 days Universal opt-out required
TX 45 days + 45 days
NH 45 days + 45 days
NJ 45 days + extension Universal opt-out required (eff. 7/15/2025)
IN 45 days + 45 days
RI 45 days + 45 days No universal opt-out

8.3 Cure Period Comparison

State Cure Period Sunset Date Post-Sunset
CA None N/A N/A
VA 30 days (expired 1/1/2025) 1/1/2025 AG discretion
CO 60 days (expired 1/1/2025) 1/1/2025 AG discretion
CT 60 days (expired 12/31/2024) 12/31/2024 AG discretion
TX 30 days (permanent) No sunset Always available
NH 60 days (expired 12/31/2025) 12/31/2025 AG discretion
NJ 18 months 7/16/2026 Division discretion
IN 30 days (permanent) No sunset Always available
RI None N/A Immediate enforcement

8.4 Breach Notification Requirements Comparison

State Timeline AG/Regulator Notice CRA Notice Threshold Notable
CA Most expedient time, ≤ 72 hours (AG) Yes (500+) 500+ Private right of action
VA Without unreasonable delay AG 1,000+ 60-day max
CO 30 days AG 500+ 30-day hard deadline
CT 60 days AG 60 days
TX 60 days AG (250+) 10,000+
NH ASAP AG/regulator 1,000+ Private right of action
NJ Most expedient time State Police first 1,000+ Must notify SP before consumers
IN ≤ 45 days AG (45 days) 1,000+ Hard 45-day max
RI 45 days (private) / 30 days (agency) AG (500+) 500+ Detailed content requirements

8.5 Universal Opt-Out Mechanism Requirements

State Universal Opt-Out Required? Effective Date
CA ☐ Yes January 1, 2023
CO ☐ Yes July 1, 2024
CT ☐ Yes January 1, 2025
TX ☐ Yes January 1, 2025
MT ☐ Yes January 1, 2025
NJ ☐ Yes July 15, 2025
NH ☐ No N/A
IN ☐ No N/A
RI ☐ No N/A

SECTION 9: THIRD-PARTY AND VENDOR ASSESSMENT

9.1 Sub-Processors

Name Services Data DPA? Jurisdictions
[________________________________] [________________________________] [________________________________] ☐ Yes ☐ No [________________________________]

9.2 Vendor Security Assessment

☐ SOC 2 Type II or equivalent
☐ Encryption standards verified
☐ Access controls reviewed
☐ Incident response confirmed
☐ Deletion / return procedures documented
☐ Subprocessor restrictions
☐ Insurance verified
☐ Multi-state breach cooperation clause

SECTION 10: AUTOMATED DECISION-MAKING AND PROFILING

10.1 Profiling Activities

  • Involves profiling? ☐ Yes ☐ No
Activity Purpose Data Used Opt-Out?
[________________________________] [________________________________] [________________________________] ☐ Yes ☐ No

10.2 Automated Decision-Making

  • Solely automated decisions with significant effects? ☐ Yes ☐ No
  • Decision logic: [________________________________]
  • Human review: [________________________________]
  • Bias testing: ☐ Yes ☐ No
  • Accuracy testing: ☐ Yes ☐ No

CA ADMT Note: California CPRA rulemaking imposes detailed obligations for Automated Decision-Making Technology (ADMT), including consumer access to information about ADMT logic and the right to opt out of certain ADMT decisions.

SECTION 11: CHILDREN'S DATA

11.1 Federal COPPA Compliance

  • Data of known children under 13? ☐ Yes ☐ No
  • Verifiable parental consent (COPPA)? ☐ Yes ☐ No ☐ N/A
  • COPPA-compliant privacy policy? ☐ Yes ☐ No
  • Age-gating? ☐ Yes ☐ No

11.2 State-Specific Children's Protections

State Requirement Status
CA Opt-in for sale/share of data of consumers 13-15 ☐ Compliant ☐ N/A
CA CA Age-Appropriate Design Code Act (CAADCA) for under-18 ☐ Compliant ☐ N/A
All states Under-13 data classified as sensitive (opt-in) ☐ Compliant ☐ N/A
Federal FTC COPPA enforcement ☐ Compliant ☐ N/A

SECTION 12: MONITORING AND REVIEW

12.1 Review Schedule

Review Type Frequency Next Review Responsible
Full DPIA ☐ Annual ☐ Biannual ☐ Other [__/__/____] [________________________________]
Processing review ☐ Quarterly ☐ Semi-annual ☐ Annual [__/__/____] [________________________________]
Mitigation effectiveness ☐ Quarterly ☐ Semi-annual ☐ Annual [__/__/____] [________________________________]
Vendor review ☐ Annual ☐ Biannual [__/__/____] [________________________________]
Regulatory landscape ☐ Quarterly ☐ Semi-annual [__/__/____] [________________________________]

12.2 Trigger Events

☐ Material change in processing
☐ New data categories or subjects
☐ New jurisdiction applicability
☐ New sub-processor or data recipient
☐ Security incident or breach
☐ Regulatory inquiry from any state AG
☐ Legislative changes in any applicable state
☐ Consumer complaints
☐ Organizational changes (M&A)
☐ Data volume change (> 25%)
☐ New state cure period expiration

12.3 Version Control

Version Date Author Changes
[____] [__/__/____] [________________________________] [________________________________]

SECTION 13: APPROVAL AND SIGN-OFF

Data Protection Officer
Name [________________________________]
Signature [________________________________]
Date [__/__/____]
Recommendation ☐ Approve ☐ Approve with Conditions ☐ Reject

CISO
Name [________________________________]
Signature [________________________________]
Date [__/__/____]
Recommendation ☐ Approve ☐ Approve with Conditions ☐ Reject

Legal Counsel
Name [________________________________]
Signature [________________________________]
Date [__/__/____]
Recommendation ☐ Approve ☐ Approve with Conditions ☐ Reject

Executive Approver
Name [________________________________]
Signature [________________________________]
Date [__/__/____]
Decision ☐ Approved ☐ Approved with Conditions ☐ Rejected ☐ Deferred

APPENDIX A: DATA FLOW DIAGRAM

[Data Subject] ---> [Collection Point] ---> [Primary Storage]
|
[Processing System]
|
+---------------+---------------+
| | |
[Analytics] [Third Party] [Backup/DR]
| | |
[Reporting] [Sub-Processor] [Archive]
Replace with actual data flow diagram.

APPENDIX B: RISK MATRIX

Negligible Limited Significant Severe
Almost Certain High High Critical Critical
Likely Moderate High High Critical
Possible Moderate Moderate High High
Unlikely Low Moderate Moderate High
Remote Low Low Moderate Moderate

APPENDIX C: GLOSSARY

Term Definition
DPIA Data Protection Impact Assessment — a process to identify and mitigate privacy risks of data processing activities
Controller Entity that determines the purpose and means of processing personal data
Processor Entity that processes personal data on behalf of a controller
Personal Data Information linked or reasonably linkable to an identified or identifiable individual
Sensitive Data Categories of personal data requiring heightened consent protections (varies by state)
Sale Exchange of personal data for monetary or other valuable consideration
Share (CA) Cross-context behavioral advertising (CA-specific concept)
Targeted Advertising Ads based on cross-site consumer activity data
Profiling Automated processing to evaluate/predict personal aspects
Universal Opt-Out Browser/device signal indicating consumer opt-out intent (GPC, etc.)
DPA Data Processing Agreement between controller and processor
SCCs Standard Contractual Clauses for international data transfers (EU)

MULTI-STATE COMPLIANCE NOTES

Building a Multi-State DPIA Framework

  1. Harmonize to the Highest Standard: Where state requirements conflict, design compliance to the most protective standard to ensure coverage across all applicable jurisdictions.

  2. Sensitive Data — Use the Broadest Definition: Aggregate sensitive data categories from all applicable states. New Hampshire's nine categories (including sex life and 1,750-foot geolocation) are among the broadest.

  3. Response Timelines — Use the Shortest Deadline: When operating across states, use the shortest applicable response timeline (generally 45 days) and the shortest extension period.

  4. Breach Notification — Multi-State Playbook: Maintain a state-by-state breach notification matrix with jurisdiction-specific requirements for timing, AG/regulator notification, CRA notification thresholds, and content requirements.

  5. Cure Period Awareness: Track cure period sunset dates and adjust compliance posture accordingly. As of 2026, only Texas and Indiana offer permanent cure periods.

  6. Universal Opt-Out Compliance: Implement GPC/universal opt-out recognition where required (CA, CO, CT, TX, MT, NJ). Even where not required, consider implementation as a best practice.

  7. DPIA Reuse: Most state laws allow a single DPIA to cover comparable processing operations and permit reuse of DPIAs conducted for other regulatory frameworks (GDPR, etc.) if scope and effect are comparable.

  8. Privilege Protections: DPIAs are generally protected from public disclosure and do not waive privilege when disclosed to state AGs during investigations. Maintain privilege assertions on all DPIA documents.

SOURCES AND REFERENCES

  1. IAPP, US State Privacy Legislation Tracker — https://iapp.org/resources/article/us-state-privacy-legislation-tracker
  2. IAPP, "New Year, New Rules: US State Privacy Requirements Coming Online as 2026 Begins" — https://iapp.org/news/a/new-year-new-rules-us-state-privacy-requirements-coming-online-as-2026-begins
  3. Mayer Brown, "2025 Mid-Year Review: US State Comprehensive Data Privacy Law Updates" — https://www.mayerbrown.com/en/insights/publications/2025/09/2025-mid-year-review-us-state-comprehensive-data-privacy-law-updates-part-1
  4. Osano, "U.S. Data Privacy Laws: A Guide to the 2026 Landscape" — https://www.osano.com/us-data-privacy-laws
  5. MultiState, "All of the Comprehensive Privacy Laws That Take Effect in 2026" — https://www.multistate.us/insider/2026/2/4/all-of-the-comprehensive-privacy-laws-that-take-effect-in-2026
  6. Baker Donelson, "Privacy Laws Ring in the New Year: State Requirements Expand in 2026" — https://www.bakerdonelson.com/privacy-laws-ring-in-the-new-year-state-requirements-expand-across-the-us-in-2026
  7. Wiley, "Five Privacy Checkpoints to Start 2026" — https://www.wiley.law/alert-Five-Privacy-Checkpoints-to-Start-2026
  8. CompliancePoint, "State Privacy Laws Taking Effect in 2026" — https://www.compliancepoint.com/privacy/state-privacy-laws-taking-effect-in-2026/
  9. EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, Art. 35
  10. Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq.
Ezel AI
Hi! Need help customizing this document? I can tailor every section to your specific case in minutes.
AI Legal Assistant
Ezel AI
Hi! Need help customizing this document? I can tailor every section to your specific case in minutes.

Insert Image

Insert Table

Watch Ezel in action (sample case)

All changes saved
Save
Export
Export as DOCX
Export as PDF
Generating PDF...
data_protection_impact_assessment_universal.pdf
Ready to export as PDF or Word
AI is editing...
Chat
Review

Customize this document with Ezel

  • Deep Legal Knowledge
    Understands case law, statutes, and legal doctrine.
  • Court-Ready Formatting
    Proper captions, certificates of service, and local rule compliance.
  • AI-Powered Editing on Your Timeline
    Edit as many times as you need. Tailor every section to your specific case.
  • Export as PDF & Word
    Download your finished document in professional PDF or DOCX format, ready to file or send.
Secure checkout via Stripe
Need to customize this document?

Related Legal Templates

State-Specific Versions

Data Protection Impact Assessment (DPIA) (AL) AL Data Protection Impact Assessment (DPIA) (AK) AK Data Protection Impact Assessment (DPIA) (AZ) AZ Data Protection Impact Assessment (DPIA) (AR) AR Data Protection Impact Assessment (DPIA) (CA) CA Data Protection Impact Assessment (DPIA) (CO) CO Data Protection Impact Assessment (DPIA) (CT) CT Data Protection Impact Assessment (DPIA) (DE) DE View all 51 states

More Compliance Regulatory Templates

ADA Compliance Audit Checklist - Physical Facilities ADA Demand Letter - Title III Public Accommodation ADA Policy Template - Employer Disability Nondiscrimination ADA Settlement Agreement - Public Accommodation Accessibility ADA Title III Complaint - Public Accommodation Discrimination AI Acceptable Use Policy Browse all

About This Template

Jurisdiction-Specific

This template is drafted for general use across all U.S. jurisdictions. State-specific versions with local statutory references are also available.

How It's Made

Drafted using current statutory databases and legal standards for compliance regulatory. Each template includes proper legal citations, defined terms, and standard protective clauses.

Important Notice

This template is provided for informational purposes. It is not legal advice. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.

Last updated: March 2026