{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Data Protection Impact Assessment (Art. 35 GDPR)","description":"DPIA for high-risk processing. Mandatory under Art. 35 when processing is likely to result in a high risk to the rights and freedoms of natural persons. Output is consulted before processing starts; may be a prerequisite for Art. 36 prior consultation with the supervisory authority.","type":"object","required":["project","controller","processing_description","necessity","risks","conclusion"],"additionalProperties":false,"properties":{"reference":{"type":"string"},"assessment_date":{"type":"string","format":"date"},"version":{"type":"string"},"project":{"type":"object","required":["name"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1},"owner":{"type":"string"},"summary":{"type":"string"}}},"controller":{"type":"object","required":["name","contact_email"],"additionalProperties":false,"properties":{"name":{"type":"string"},"contact_email":{"type":"string","format":"email"},"dpo_name":{"type":"string"},"dpo_email":{"type":"string","format":"email"}}},"processing_description":{"type":"object","required":["nature","scope","context","purposes"],"additionalProperties":false,"properties":{"nature":{"type":"string"},"scope":{"type":"string"},"context":{"type":"string"},"purposes":{"type":"array","items":{"type":"string"},"minItems":1},"data_flows":{"type":"string"}}},"high_risk_triggers":{"type":"array","description":"WP29/EDPB criteria making the processing high-risk (any two+ usually triggers DPIA).","items":{"type":"string"}},"necessity":{"type":"object","required":["lawful_basis","proportionality"],"additionalProperties":false,"properties":{"lawful_basis":{"type":"string"},"proportionality":{"type":"string"},"data_minimisation":{"type":"string"},"retention":{"type":"string"}}},"consultations":{"type":"array","items":{"type":"object","required":["party","outcome"],"additionalProperties":false,"properties":{"party":{"type":"string"},"date":{"type":"string","format":"date"},"outcome":{"type":"string"}}}},"risks":{"type":"array","minItems":1,"items":{"type":"object","required":["id","description","likelihood","severity"],"additionalProperties":false,"properties":{"id":{"type":"string"},"description":{"type":"string"},"likelihood":{"type":"string","enum":["low","medium","high"]},"severity":{"type":"string","enum":["low","medium","high"]},"impact":{"type":"string"},"mitigations":{"type":"array","items":{"type":"string"}},"residual_likelihood":{"type":"string","enum":["low","medium","high"]},"residual_severity":{"type":"string","enum":["low","medium","high"]}}}},"dpo_opinion":{"type":"string"},"conclusion":{"type":"object","required":["decision"],"additionalProperties":false,"properties":{"decision":{"type":"string","enum":["proceed","proceed_with_conditions","do_not_proceed","prior_consultation_required"]},"rationale":{"type":"string"},"review_date":{"type":"string","format":"date"}}},"signoff":{"type":"object","additionalProperties":false,"properties":{"controller_signatory":{"type":"string"},"controller_title":{"type":"string"},"dpo_signatory":{"type":"string"}}}}}