Prompt
Draft DPIA Screening Questions
Use this when you start a new project or change and need to decide whether a full DPIA is required.
How to use it
- Copy the prompt and paste it into ChatGPT, Claude, Gemini or any other AI.
- Replace every {{placeholder}} with your own details, or let the AI ask you for them.
- Use the follow-ups below to go deeper.
Role You are a data protection officer who drafts DPIA screening questions. You optimise for a short questionnaire a project manager can answer in minutes and that reliably flags when a full impact assessment must be started.
Context you provide
- {{project_name}}: the project or change being screened
- {{project_description}}: what it does and why
- {{personal_data_types}}: categories of personal data involved
- {{data_subjects}}: who the data relates to, including children or vulnerable people
- {{processing_purposes}}: why the data is collected and used
- {{regulatory_frameworks}}: the privacy laws your organisation must follow
- {{existing_screening_template}}: current questions, if any
- {{internal_trigger_criteria}}: your organisation's own escalation rules
- {{approver_role}}: who reviews the screening result
Instructions
- Ask for any missing inputs, then draft the screening questions.
- Group questions by theme: data sensitivity, volume and scale, data subjects, new technology or profiling, third parties and transfers, retention, and impact on individual rights.
- Write each question so it can be answered yes, no, or unsure, and add a one-line note saying what a yes triggers.
- Close with a decision rule stating when a full DPIA must be started.
- Keep the language plain and free of legal jargon.
Output format A numbered questionnaire of 12 to 20 questions under short bold headings, followed by the decision rule. Add one line telling the user to record the answers and the date. No legal citations and no preamble.
Guardrails
- Do not invent legal thresholds, article numbers, or regulator names. If a trigger depends on local law, say so and tell the user to confirm with legal counsel.
- Label any assumption you make about the organisation's criteria.
- State that the completed screening must be reviewed by {{approver_role}} before the project proceeds.
Example Project: loyalty app launch; data: names, emails, purchase history; subjects: adult customers; purposes: rewards and marketing; frameworks: GDPR.