BSA submitted comments on the European Data Protection Board's (EDPB) draft voluntary Data Protection Impact Assessment (DPIA) template. The template aims to promote more consistent GDPR compliance across the EU. BSA emphasized that the template should remain flexible, risk-based, and practical to implement across different organizations and processing activities. BSA's recommendations focus on preserving flexibility, reinforcing the risk-based nature of DPIAs, providing greater clarity on when DPIAs are required, ensuring proportionality, and promoting interoperability with other frameworks, including the EU AI Act. BSA also stressed that the template should support compliance without creating new obligations beyond the GDPR or encouraging a rigid, check-the-box approach to privacy risk assessments.

The EDPB has indicated that national data protection authorities may align their own templates with the EDPB model. As a result, the final template could effectively become a de facto standard for organizations conducting privacy risk assessments and demonstrating GDPR compliance across Europe.