← Back to Products

DPIA — Football Mobility Trainer (Personal Training Scope)

Purpose: Assess privacy risks for an internal MVP that captures only routine/adherence data for personal training. No health assessment or treatment data. This SFA supports a generic DPIA structure aligned to common GDPR/ICO expectations.

0) DPIA Metadata

1) Project & Roles

2) Screening (DPIA Trigger)

High-risk indicators
Special category
Children/minors
Large scale
Transfers
ADM/Profiling
Record why a DPIA is or isn't required and whether residual high risk could trigger regulator consultation.

3) Systematic Description of Processing

4) Purpose, Lawful Basis & (If Applicable) Special Category Condition

If Legitimate Interests, complete/attach an LIA; if Consent, ensure easy withdrawal and avoid imbalance of power.
Special category (Art. 9) — complete only if special category is processed

5) Necessity & Proportionality

6) Data Minimisation & Categories

Personal data captured (tick what applies)
Explicitly exclude where possible: diagnosis/treatment, injury details, medical images, free-text health notes.

7) Data Flows, Hosting, Subprocessors

International transfers (complete if transfers occur)

8) Telemetry, Cookies/SDKs, and Communications

9) Automated Decision-Making / Profiling (Art. 22)

10) Access Controls & Security

Controls (tick what applies)

11) Incident Response & Breach Notification

12) Retention & Deletion

13) Transparency & Data Subject Rights

14) Safeguarding (if minors)

Complete if "minors = yes"

15) Risk Register (Likelihood × Impact)

Use this to document risks to individuals (not just to the business). Residual risk should reflect mitigations.
Risk scenario Impact (1–5) Likelihood (1–5) Mitigations / controls Residual notes / owner

16) Consultation, Residual Risk Decision & Approvals

Consultation