Skip to content

Privacy impact assessment

Check a new project that uses personal data: what you collect, the risks to people and how you reduce them.

Fill it in and preview

Privacy impact assessment

Organisation: Northgate Health Ltd
Project or system: Patient reminder app
Owner: Head of Digital
Assessed by: Priya Nair, Data Protection Officer
Date: 9 April 2027

1. What the project does

Sends appointment reminders by text and lets patients change their booking online.

2. Why personal data is needed

To remind people of appointments and cut missed visits.

3. The data

Personal data used

Name
Mobile number
Appointment time and clinic
No medical notes

Whose data it is

Patients over 16, about 12,000 people

Who else receives it

The text message provider, as our processor, under contract

How long it is kept

Reminders deleted 30 days after the appointment

4. Risks to people

A wrong number could reveal an appointment to a stranger
A breach could expose names and numbers

5. Safeguards

Confirm the number at booking
No clinic details in the text
Encrypted storage and staff access limits

6. Risk that remains

Level after safeguards: Risk that remains after the safeguards

7. Decision and next steps

Go ahead after the number check is built. Review again in 12 months.

Signed off by: ______________________ Date: ______________

This assessment is a record of the organisation's own review. It is not legal advice.

Templates are a careful starting point, not legal advice. Where the law matters, check what applies where you are.

Company and legal

What this template is for

A privacy impact assessment (data protection impact assessment) for a new system or project: data used, why, risks to people, safeguards and sign-off.

It is free to fill in online, needs no account, and downloads as a Word document or a PDF. See all Company and legal templates

Company and legal

What you fill in

The form asks for 15 details. The document fills itself in as you type.

  • Organisation

    For example: Northgate Health Ltd

  • Project or system

    For example: Patient reminder app

  • Project owner

    For example: Head of Digital

  • Assessment carried out by

    For example: Priya Nair, Data Protection Officer

  • Date

    For example: 9 April 2027

  • What the project does

    Two or three sentences, in plain words.

    For example: Sends appointment reminders by text and lets patients change their booking online.

  • Why personal data is needed

    For example: To remind people of appointments and cut missed visits.

  • Personal data used

    One item per line. Mark any sensitive data.

    For example: Name Mobile number Appointment time and clinic No medical notes

  • Whose data it is

    For example: Patients over 16, about 12,000 people

  • Who else receives the data (optional)optional

    For example: The text message provider, as our processor, under contract

  • How long it is kept

    For example: Reminders deleted 30 days after the appointment

  • Risks to people

    One risk per line. Think of harm to the person, not to the company.

    For example: A wrong number could reveal an appointment to a stranger A breach could expose names and numbers

  • Safeguards for each risk

    For example: Confirm the number at booking No clinic details in the text Encrypted storage and staff access limits

  • Risk that remains after the safeguards

  • Decision and next steps

    For example: Go ahead after the number check is built. Review again in 12 months.

Company and legal

What is inside

The parts of this document, in order.

  1. 11. What the project does
  2. 22. Why personal data is needed
  3. 33. The data
  4. 44. Risks to people
  5. 55. Safeguards
  6. 66. Risk that remains
  7. 77. Decision and next steps

Templates

How it works

  1. 01

    Fill in

    Type your details in the form. The document fills itself in as you type; click any gap to jump to its field.

  2. 02

    Check

    Read it through. Gaps you have not filled stay marked, so nothing goes out half done.

  3. 03

    Download

    Save it as a Word document to edit further, or as a PDF to send or print.

Make it yours with AI

Open it in the chat and ask for changes: shorter, firmer, another situation, another language.

Adapt it with nerix

Company and legal

Questions people ask

What details does this template ask for?

The form asks for 15 details, starting with Organisation, Project or system, Project owner, Assessment carried out by, Date. 1 more are optional.

Can I download this template as Word or PDF?

Yes. When you have filled in the form, save it as a Word document to keep editing, or as a PDF to send or print. It is free and needs no account.

Is what I type sent anywhere?

No. What you type stays in your browser while you fill in the document. It only goes to nerix if you choose to open the template in the chat.

What should I check before I use this template?

Many data protection laws require an assessment for high-risk uses of personal data, and they differ by country. This template is a working structure, not legal advice. Ask your data protection officer or adviser where one is required.

Are these company templates free?

Most are. Fill in and download them for free as Word or PDF, with no account. A few longer documents are premium: free to fill in, paid once to download, and marked with their price.

Is a template the same as legal advice?

No. A template is a careful starting point. Company, contract and data protection law differ by country, so have a lawyer read anything that carries real risk before you sign.

Can I change the clauses?

Yes. Download the Word version and edit it, or open the template in the nerix chat and ask for a clause that is stricter, shorter or in another language.
  • Quality and audits7 min read

    GDPR checklist for small businesses

    A GDPR checklist for small businesses, article by article. Lawful basis, privacy notice, processors, security, 72 hour breach reports and data subject requests.