# Data Protection Impact Assessment (DPIA) — health app or platform

Template following GDPR Article 35(7) and the EDPB/WP29 criteria (WP248 rev.01). Replace the bracketed text. Not legal advice; your DPO adapts it.

**Controller:** [name, address, contact]  **DPO:** [name, contact]  **Version:** [1.0]  **Date:** [YYYY-MM-DD]  **Next review:** [YYYY-MM-DD]

## 0. Need for a DPIA

| Criterion (WP248) | Applies? | Note |
|---|---|---|
| Evaluation or scoring | [yes/no] | |
| Automated decisions with legal or similar effect | | |
| Systematic monitoring | | |
| Sensitive data (Art. 9) | yes | health data |
| Large scale | | [number of users / records] |
| Matching or combining datasets | | |
| Vulnerable people (patients, children) | yes | |
| Innovative technology (AI, wearables) | | |
| Prevents exercising a right or using a service | | |

Two or more → DPIA required. National Art. 35(4) list checked: [authority, entry].

## 1. Description of the processing (Art. 35(7)(a))

### 1.1 Purposes
| # | Purpose | Description |
|---|---|---|
| P1 | [Store the person's health records] | |
| P2 | [Share records with a clinic the person approves] | |
| P3 | [Reminders and notifications] | |
| P4 | [Anonymised statistics] | |
| P5 | [AI feature: …] | |

### 1.2 Data, per purpose
| Purpose | Data categories (mark health data) | Source | Recipients | Retention | Transfer outside EU / mechanism |
|---|---|---|---|---|---|
| P1 | | | | | |

### 1.3 Actors and contracts
| Role | Entity | Contract (Art. 28 / joint controller) | Sub-processors |
|---|---|---|---|
| Processor: hosting | | | |
| Processor: analytics / crash reporting | | | |
| Processor: support tooling | | | |
| Processor: AI provider | | | |

### 1.4 Technology and data flows
[Architecture summary; where data rests; encryption at rest / in transit; identity; logging; backups; environments. Attach the data-flow diagram.]

## 2. Necessity and proportionality (Art. 35(7)(b))

| Purpose | Art. 6 basis | Art. 9(2) exception | Why necessary | Minimisation decisions |
|---|---|---|---|---|
| P1 | [6(1)(b) contract] | [9(2)(a) explicit consent] | | |

Information to the people (Art. 13/14): [where, how].
Rights in the product: access [ ], rectification [ ], erasure [ ], portability [ ], objection [ ], withdraw consent [ ], children/guardians [ ].
Retention and deletion mechanism: [ ].
Processor contracts and audit rights: [ ].

## 3. Risks to the rights and freedoms of the people (Art. 35(7)(c))

Scale: likelihood (negligible / limited / significant / maximum) × severity (same).

| # | Risk event | Purpose(s) | Threat sources | Likelihood | Severity | Notes |
|---|---|---|---|---|---|---|
| R1 | Illegitimate access (breach, insider, over-broad sharing) | | | | | |
| R2 | Unwanted modification (wrong data relied on by a clinician; sync errors; AI writes) | | | | | |
| R3 | Disappearance (loss, account takeover, vendor shutdown) | | | | | |
| R4 | Re-identification from statistics | | | | | |
| R5 | Inference of conditions from behaviour / notifications | | | | | |
| R6 | Third-party SDKs leaking identifiers + health context | | | | | |
| R7 | Children's data | | | | | |
| R8 | Discrimination (insurers, employers) | | | | | |

## 4. Measures (Art. 35(7)(d))

| Risk | Measure | Owner | Status | Residual likelihood | Residual severity |
|---|---|---|---|---|---|
| R1 | Encryption at rest and in transit; strong authentication; access scoped by consent and time; per-record access logs visible to the person | | | | |
| R1 | Role- and relationship-based access; no shared accounts; staff confidentiality | | | | |
| R2 | Provenance per source; versioning; no automated writes without review | | | | |
| R3 | Backups with tested restore; export in the product; exit plan | | | | |
| R4 | Aggregation thresholds; k-anonymity / differential privacy; no small cells | | | | |
| R5 | Notification contents reveal nothing on lock screen; opt-in | | | | |
| R6 | No advertising/tracking SDKs; pseudonymous crash reports; vendor review | | | | |
| R7 | Guardian consent flow; age thresholds per member state | | | | |
| all | Incident response with 72-hour clock; secure development; training | | | | |

## 5. Consultation

DPO advice (Art. 35(2)): [date, summary].
Views of the people / representatives (Art. 35(9)): [panel, association, date] or [why not sought].
Prior consultation of the authority (Art. 36): [not needed / needed because …].

## 6. Sign-off and review

| Role | Name | Date | Signature |
|---|---|---|---|
| Controller's management | | | |
| DPO | | | |

Review triggers: new purpose, new data category, new processor or transfer, new technology, incident. Scheduled review: [every 12 months].