夜雨聆风欧洲数据保护委员会 (EDPB) 的数据保护影响评估 (DPIA) 模板正在公开征求意见（截止时间：2026 年 6 月 9 日），公开征求意见结束后，该模板将最终定稿（并进行必要的修改）。针对欧盟官方发布的这份DPIA模板，原文内容如下：
0 OVERVIEW OF THE PROCESSING
处理活动概述
0.1 Controller(s)
数据控制者
Note: If there areJoint controllers, one table per controller, adding a row to identify their obligations and tasks
注：若存在共同控制者，需为每位控制者单独制作表格，并增加一行列明其义务与职责。
Controller | |
Management units responsible for the processing inside the organisation 组织内部负责该处理活动的管理部门 | |
Main establishment/point of contact or representative 主要营业地 / 联络点或代表机构 | |
Information about the DPO or similar function, if applicable 数据保护官（DPO）或同类职能人员的相关信息（如适用） |
说明：指明《通用数据保护条例》（GDPR）项下的数据控制者。提供所有必要的联系方式（组织内部负责相关处理活动的管理部门、主要营业地与联络点、代表、数据保护官（DPO）等）。如适用，指明共同控制者，明确界定各方的义务与职责。
0.2 Processor(s) and sub-processor(s)
Processor 数据处理者 | Definition of their obligations and tasks 其义务与职责的界定 | |
1 | ||
2 | ||
N |
0.3 Name of the processing
Internal name given to the processing (the given name in the record of processing activities) 为该处理活动指定的内部名称（即处理活动记录中使用的名称） | |
Current version (explaining the history of changes made to the processing in the past, if any) 当前版本（如需说明过往对该处理活动所作的变更历史，请予以说明） |
0.4 Planning of the processing
Estimated launch date 预计启动日期 | |
Estimated end date or expiration conditions (if applicable, i.e. because the processing is temporary) 预计结束日期或终止条件（如适用，例如因处理活动为临时性的） |
0.5 DPIA technical sheet
Current version and version log (explaining the history of changes made to the information contained in the DPIA template for this processing, if any) 当前版本及版本记录（说明对本处理活动的 DPIA 模板中所载信息的历次变更历史，如有） | |
Team involved in conducting this DPIA (providing details of their roles, tasks, responsibilities, etc.) 开展本次 DPIA 的参与团队（列明其角色、任务、职责等详细信息） | |
Guidelines, standards, codes of conduct and other reference materials used to conduct this DPIA 开展本次 DPIA 所依据的指南、标准、行为准则及其他参考资料 | |
Reasons to conduct the DPIA 开展本次 DPIA 的原因 |
已存在的高风险处理活动，但风险状况发生变化： * Data processing has changed. 数据处理方式已发生变更 * The organisational or societal context for the processing activity has changed. How? _____________________________________ 处理活动的组织环境或社会环境已发生变更。 具体情况：_____________________________________ |
Scope of this DPIA (what has been considered and what has been left out of the assessment and why) 本次数据保护影响评估（DPIA）的范围（本次评估涵盖内容、未纳入评估的内容及其原因） | |
Completion date 完成日期 | |
Formal validation date (approval of the DPIA as complete and finished by a responsible official) 正式生效日期（由负责官员审批确认本 DPIA 已完整完成的日期） | |
Is the DPIA (or parts of it) intended to be published or to be shared externally? 本 DPIA（或其部分内容）是否拟对外公布或共享？ | * No * Yes it is going to be published: How?____________ * Yes, it is going to be shared externally: How? ______________
|
1 SYSTEMATIC DESCRIPTION OF THE PROCESSING
1.1 High-level description of the processing
1.1.a Processed personal data
Processed personal data (item or element) 已处理的个人数据（项目或要素） | Explanation (data type, data subject category, additional details) 说明（数据类型、数据主体类别、补充细节） | Special category of personal data 特殊类别个人数据 | |
1 | □No Yes: □Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. 显示种族或民族出身、政治观点、宗教或哲学信仰，以及工会成员身份的数据。 □Genetic data. 基因数据 □ Biometric data for the purpose of uniquely identifying a natural person. 用于唯一识别自然人的生物识别数据 □ Data concerning health. 健康相关数据 □ Data concerning a natural person's sex life or sexual orientation. 有关自然人性生活或性取向的数据 |
1.1.b Purposes of the processing
Purpose: specific and explicit reasons for processing the personal data 目的：处理个人数据的具体且明确的理由 | Personal data involved (considering personal data listed in 1.1.a) and justification 涉及的个人数据（参考 1.1.a 中所列个人数据）及合法性依据 | |
1 | ||
2 | ||
N |
1.1.c Secondary or compatible uses
Secondary or compatible uses of the data 数据的次要用途或相容用途 | Personal data involved (considering personal data listed in 1.1.a), under what conditions and assessment of compatibility 涉及的个人数据（参考 1.1.a 中所列个人数据）、适用条件及相容性评估 | |
1 | ||
2 | ||
N |
1.1.d 1.1.dNature, scope and context of the processing
Nature of the processing: the way personal data will be handled (operations involved, technologies used, etc.). 处理的性质：个人数据将被处理的方式（所涉及的处理操作、使用的技术等）。 | |
Scope of the processing: breadth and extent (the volume or scale given the number of data subjects or data items, geographical and organisational reach, frequency or duration for the data subject, etc.). 处理的范围：处理的广度和程度（基于数据主体或数据项的数量所体现的数据量或规模、地域和组织覆盖范围、对数据主体而言的处理频率或持续时间等）。 | |
Context of the processing: circumstances and environment (use cases, supported business processes, status of the controller and relationship with the data subjects, data subjects categories and potential vulnerable groups, cross-border processing, international transfers, etc.). 处理的情境：处理所处的具体情况和环境（使用场景、所支持的业务流程、控制者的身份以及其与数据主体之间的关系、数据主体类别及潜在弱势群体、跨境处理、国际传输等）。 | Is this a cross-border processing? * No * Yes (justification and details): ____________ Is personal data going to be transferred to a recipient in a third country or international organisation? * No * Yes (justification and details): ____________ 是否属于跨境处理？
个人数据是否将被传输至第三国或国际组织的接收方？
|
1.2 Functional description
Note: Ideally, this table should be supplemented with one or more diagrams representing data flows or a similar figure.
注：理想情况下，本表应辅以一项或多项表示数据流的数据流程图或类似图示。
Processing phase or stage 处理环节或阶段 | Type of operations 处理操作类型 | Explanation 说明 | |
1 | * Collection * Use * Storage * Sharing and Transfer * Deletion and Destruction
|
说明：以结构化方式概述处理流程，将其分解为不同阶段或环节。说明由控制者、处理者及子处理者构成的完整链路信息。
说明数据生命周期与数据流：全面概述个人数据从收集到删除的整个生命周期管理方式。需包含的关键方面： - **收集**：说明收集何种数据以及如何收集，包括数据来源及向数据主体提供的信息。 - **使用**：详细说明对数据执行的操作、使用的技术，以及涉及的任何自动化决策或画像分析。明确数据使用方式及是否与其他数据集合并使用。 - **存储**：说明数据存储的位置与方式（本地物理存储、云存储、第三方存储），以及哪些主体有权访问数据。 - **共享与传输**：说明向第三方共享数据或向欧盟境外传输数据的情况，以及所采用的法律机制或工具（如标准合同条款SCC、充分性认定决定等）。 - **删除与销毁**：说明数据不再需要时，安全删除数据的标准与流程，包括永久清除的具体方法。
1.3 Means of processing, supporting assets and underlying architecture
处理方式、支撑性资产及底层架构
Processing phase or stage (considering the functional description under 1.2) 处理环节或阶段（结合第 1.2 节下的功能描述） | Means of processing and supporting assets 处理方式及支撑性资产 | Explanation 说明 |
说明：根据第1.2节的功能描述，说明**处理方式**。说明处理活动如何开展，开展个人数据处理所采用的技术与组织管理方法、工具、基础设施及资源。 特别地，提供一份核心支撑资产清单。“资产”通常指用于处理个人数据、支持数据全生命周期有效管理的任何有形或无形资源。在数据保护场景下，资产既是价值载体，也是风险载体。 资产示例包括： - 硬件、基础设施与网络资产（如服务器、笔记本电脑、移动设备、存储介质、扫描仪、VPN网关） - 软件（数据库引擎、业务应用系统） - 应用程序接口（API）与模型 - 人员（普通用户、管理员、开发人员、运维人员、支持人员、决策人员） - 场所与场地（数据中心、档案库房） - 组织管理类资产（政策、流程、与处理者及子处理者签订的合同）等。 需纳入对**风险分析至关重要**的资产，即：一旦被破坏，会对数据主体的权利与自由造成重大非一般性影响的资产（例如直接存储或处理个人数据的资产、控制访问权限或保护数据安全的资产、对外暴露或高影响组件，如面向公众的门户、API或第三方数据共享接口等）。 极其微小、通用或易于替换的组件通常无需单独列出。 请按逻辑模块、技术层级、功能类别等方式对资产进行分组。在每组内简要说明其包含内容及与本次处理活动的关联，并在后续的风险评估与管理中采用相同粒度。 在完整性与可管理性之间保持平衡，将设备级、服务级等非常细致的清单单独存放于技术文档中，并对与风险评估和管理密切相关的底层架构进行说明。
1.4 Compliance with approved codes of conduct
遵守经批准的行为准则
Code of conduct 行为准则 | Explanation | |
1 | * Compliance is likely to be required (legal obligation). Why?:______________________ * Compliance is necessary or beneficial. Why?:________________
|
说明：对已核准行为准则的遵守情况。如适用，分析相关合规义务；或说明控制者认为遵守该等准则具有必要性或益处的理由。
2、ANALYSIS OF THE PROCESSING
2.1 Lawfulness of the processing
2.1.a Legal basis
2 处理活动分析
2.1 处理活动的合法性
2.1.a 法律依据
Purpose/use (considering 1.1.b on processing purposes and 1.1.c on secondary or compatible purposes) 目的/用途（结合第 1.1.b 项关于处理目的以及第 1.1.c 项关于次要目的或相容目的的内容） | Legal basis (Article 6(1) GDPR) 法律依据（GDPR 第 6 条第 1 款） | Justification (if applicable, analyse the legitimate interests pursued by the controller or by a third party conducting a balancing test) 论证说明（如适用，应通过利益衡量测试，分析控制者或第三方所追求的合法利益） |
* (a) The data subject has given consent to the processing of his or her personal data for one or more specific purposes. * (b) The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. * (c) The processing is necessary for compliance with a legal obligation to which the controller is subject. * (d) The processing is necessary in order to protect the vital interests of the data subject or of another natural person. * (e) The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. * (f) The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
|
2.1.b 2.1.b Reasons to lift the processing prohibition
2.1.b 解除处理禁止的理由
Special category of personal data (item or element, considering 1.1.a) 特殊类别个人数据（项目或要素，结合第 1.1.a 项） | Reasons to lift the processing prohibition (Article 9(2) GDPR) 解除处理禁止的理由（GDPR 第 9 条第 2 款） | Justification 论证说明 |
* (a) The data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition may not be lifted by the data subject. * (b) The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject. * (c) The processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent. * (d) The processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects. *(e) The processing relates to personal data which are manifestly made public by the data subject. * (f) The processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity. * (g) The processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. * (h) The processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3 article 9 GDPR. * (i) The processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy. * (j) The processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
|
2.2Data minimisation, retention periods, and data quality
2.2.a Data minimisation and retention periods
2.2 数据最小化、保存期限及数据质量
2.2.a 数据最小化及保存期限
Processed personal data (item or element, considering 1.1.a) 所处理的个人数据（项目或要素，结合第 1.1.a 项） | Justification of the need and relevance of the data 数据必要性及相关性的论证说明 | Recipients 接收方 | Justification 论证说明 | Retention period 保存期限 | Justification 论证说明 |
2.2.b Data quality
Processed personal data (item or element, considering table 1.1.a) 所处理的个人数据（项目或要素，结合表 1.1.a） | Quality metrics, requirements or thresholds 质量指标、要求或阈值 | Justification 论证说明 |
2.3 Measures supporting compliance
2.3.a Measures supporting compliance with principles in Article 5(1)(a-f) GDPR
2.3 支持合规的措施
2.3.a 支持遵守 GDPR 第 5 条第 1 款（a）至（f）项原则的措施
Compliance with Article 5(1)(a-f) GDPR principles 遵守 GDPR 第 5 条第 1 款（a）至（f）项原则的情况 | List of supporting measures 支持性措施清单 | Discussion of appropriateness and effectiveness 适当性及有效性讨论 | Implementation status 实施状态 |
Fairness principle 公平性原则 | *Planned *Partially implemented *Implemented
| ||
Transparency principle 透明性原则 | *Planned *Partially implemented *Implemented | ||
Purpose limitation principle 目的限制原则 | *Planned *Partially implemented *Implemented | ||
Data minimisation principle 数据最小化原则 | *Planned *Partially implemented *Implemented | ||
Accuracy principle 准确性原则 | *Planned *Partially implemented *Implemented | ||
Storage limitation principle 存储限制原则 | *Planned *Partially implemented *Implemented | ||
Integrity and confidentiality principle 完整性与保密性原则 | *Planned *Partially implemented *Implemented | ||
Accountability principle 问责原则 | *Planned *Partially implemented *Implemented |
2.3.b Measures supporting the exercise of data subjects’ rights
2.3.b 支持数据主体权利行使的措施
Data subject rights 数据主体权利 | List of supporting measures 支持性措施清单 | Discussion of appropriateness and effectiveness 适当性及有效性讨论 | Implementation status 实施状态 |
Information to be provided to the data subjects (Articles 12, 13 and 14GDPR) 向数据主体提供的信息（GDPR 第 12 条、第 13 条和第 14 条） | * Planned * Partially implemented * Implemented
| ||
Right of access and to data portability (Articles 15 and 20 GDPR) 访问权及数据可携权（GDPR 第 15 条和第 20 条） | *Planned *Partially implemented *Implemented | ||
Right to rectification and to erasure (Articles 16, 17 and 19GDPR) 更正权及删除权（GDPR 第 16 条、第 17 条和第 19 条） | *Planned *Partially implemented *Implemented | ||
Right to object and to restriction of processing (Article 18, 19 and 21 GDPR) 反对权及限制处理权（GDPR 第 18 条、第 19 条和第 21 条） | *Planned *Partially implemented *Implemented | ||
Right not to be subject to a decision based solely on automated processing (Article 22 GDPR) 不受仅基于自动化处理的决定约束的权利（GDPR 第 22 条） | *Planned *Partially implemented *Implemented |
2.3.c Measures supporting compliance with other GDPR requirements
2.3.c 支持遵守其他 GDPR 要求的措施
Compliance with other GDPR requirements 遵守其他 GDPR 要求的情况 | List of supporting measures 支持性措施清单 | Discussion of appropriateness and effectiveness 适当性及有效性讨论 | Implementation status 实施状态 |
Requirements on the provisions and withdrawal of consent (Article 7 GDPR) 同意提供及撤回相关要求（GDPR 第 7 条） | * Planned * Partially implemented * Implemented | ||
Relationship with processors (Article 28 GDPR) 与处理者之间的关系（GDPR 第 28 条） | *Planned *Partially implemented *Implemented | ||
Safeguards relating to international transfer(s) (Chapter V GDPR) 国际传输相关保障措施（GDPR 第五章） | *Planned *Partially implemented *Implemented |
2.3.d Measures supporting data protection by design and by default
2.3.d 支持设计和默认的数据保护的措施
Data protection by design and by default (Article 25 GDPR) 设计和默认的数据保护（GDPR 第 25 条） | List of supporting measures 支持性措施清单 | Discussion of appropriateness and effectiveness 适当性及有效性讨论 | Implementation status 实施状态 |
* Planned * Partially implemented * Implemented | |||
*Planned *Partially implemented *Implemented |
2.3.e Measures supporting security of processing
2.3.e 支持处理安全性的措施
Security of processing (Article 32 GDPR) 处理安全性（GDPR 第 32 条） | List of supporting measures 支持性措施清单 | Discussion of appropriateness and effectiveness 适当性及有效性讨论 | Implementation status (planned/partially implemented/ implemented) 实施状态（已计划/已部分实施/已实施） |
* Planned * Partially implemented * Implemented | |||
*Planned *Partially implemented *Implemented |
3 CONSIDERATIONS ON NECESSITY AND PROPORTIONALITY
3.1 Impacts of the processing on the rights and freedoms of data subjects
3 必要性和相称性方面的考量
3.1 处理活动对数据主体权利和自由的影响
Threats posed by the processing, as it has been designed and planned to be implemented (including technical, legal/contractual and organisational measures to mitigate risk(s)) 处理活动按其设计及计划实施方式所产生的威胁（包括用于降低风险的技术、法律/合同及组织措施） | How can it be materialised? 该威胁可能如何具体发生？ | Risk sources (purpose, wrong design and weaknesses, exposures, etc.) 风险来源（目的、错误设计及缺陷、暴露等） | Impact on data subjects’ rights and freedoms 对数据主体权利和自由的影响 | |
1 |
3.2 Assess the necessity of the processing
3.2 评估处理活动的必要性
Evaluate if the envisaged processing is effective and the least intrusive for the data subject’s rights and freedoms. Provide evidence (for example, concerning the different considered alternatives) and justification. 评估拟进行的处理活动是否有效，并且是否为对数据主体权利和自由侵扰程度最低的方式。请提供证据（例如，关于已考虑的不同替代方案）及论证说明。 |
3.3 Assess the proportionality of the processing
3.3 评估处理活动的相称性
Discuss the importance of the processing and its potential benefits for the data subject and collectively. Conduct an evaluation that compares the potential impacts on rights and freedoms of data subjects with the advantages resulting from the processing, to ensure that the processing is proportional and fairly balanced. Provide evidence and justification. 讨论该处理活动的重要性及其对数据主体和集体可能产生的潜在利益。开展评估，将对数据主体权利和自由的潜在影响与该处理活动所产生的利益进行比较，以确保该处理活动具有相称性并实现公平平衡。请提供证据及论证说明。 |
4 RISK ASSESSMENT AND MANAGEMENT
4.1 Risk assessment and management
4.1.a Impacts on the rights and freedoms of the data subjects caused by non-default, accidental, unlawful, or abnormal events
Note: Identify, at least, threats that could lead to illegitimate access, undesired modification and disappearance of data.
4 风险评估与管理
4.1 风险评估与管理
4.1.a 因非默认、意外、非法或异常事件而对数据主体权利和自由造成的影响
注：至少应识别可能导致非法访问、非预期修改以及数据灭失的威胁。
Threats posed by malfunctions and deviations from design and default, threats to data confidentiality, integrity and availability (related to cybersecurity), etc. 故障以及偏离设计和默认状态所造成的威胁、对数据保密性、完整性和可用性的威胁（与网络安全相关）等。 | How can it be materialised? 该威胁可能如何具体发生？ | Risk sources (exposures and errors, vulnerabilities etc.) 风险来源（暴露、错误、漏洞等） | Impacts on data subjects’ rights and freedoms 对数据主体权利和自由的影响 | |
1 |
4.1.b Method
Explain the details of the method followed to assess and manage risk and provide the necessary information to interpret the following:
4.1.b 方法
说明用于评估和管理风险的方法的具体细节，并提供解释以下内容所需的信息：
If an established method is used, provide the link to the external source introducing this method. ● 可能性和严重性等级及其含义（通常使用 2 至 5 级量表）。 ● 风险度量指标。 ● 风险优先级排序方法。 ● 风险接受水平。 如采用既定方法，请提供介绍该方法的外部来源链接。 |
4.1.c Inherent risk assessment
Note: If available, this table can be supplemented with one or more diagrams, charts, maps, priority lists, etc. documenting inherent risk assessment from different perspectives.
4.1.c 固有风险评估
注：如有，本表可辅以一项或多项图表、图形、地图、优先级列表等，从不同角度记录固有风险评估。
Risks to the data subject’s rights and freedoms (include scenarios laid out in the first column in 3.1 and 4.1.a) 对数据主体权利和自由造成的风险（包括第 3.1 节和第 4.1.a 节第一列中列明的场景） | Likelihood 可能性 | Severity 严重性 | Modulating factors 调节因素 | Risk level 风险等级 | Discuss whether the risk is acceptable or not 讨论该风险是否可接受 | |
1 |
4.2 Action plan
4.2.a Additional mitigating measures
Note: Include in this table all types of measures (see the different categories in section 2.3)
4.2 行动计划
4.2.a 额外的风险缓解措施
注：本表应包括所有类型的措施（见第 2.3 节中的不同类别）。
Technical, legal/contractual and organisational measures 技术、法律/合同及组织措施 | Mitigated risks (considering 4.1.c) 所缓解的风险（结合第 4.1.c 节） | Discussion of appropriateness and effectiveness 适当性及有效性讨论 | Implementation status (partially implemented/ implemented) 实施状态（已部分实施/已实施） | |
1 | * Planned * Partially implemented * Implemented |
4.2.b Residual risk assessment
4.2.b 剩余风险评估
Reassessed risks to the data subject’s rights and freedoms 重新评估后对数据主体权利和自由造成的风险 | Additional mitigating measures that apply 适用的额外风险缓解措施 | Residual likelihood 剩余可能性 | Residual severity 剩余严重性 | Residual risk level 剩余风险等级 | Discuss whether the risk is acceptable or not 讨论该风险是否可接受 | |
1 |
4.2.c Plan
Provide information about the necessary activities to properly add these new measures to the processing, so as to properly manage the risks for the rights and freedoms of individuals, and to monitor, review and update the proposed measures once the processing is being carried out.
4.2.c 计划
提供有关必要活动的信息，以便将这些新措施适当地纳入处理活动中，从而妥善管理对个人权利和自由造成的风险，并在处理活动开展后，对拟采取的措施进行监测、审查和更新。
● 具体活动、负责团队、时间安排等。 ● 包含详细信息的外部文件或附件链接。 |
5 INVOLVEMENT OF INTERESTED PARTIES
5.1 DPO advice
5 利益相关方的参与
5.1 数据保护官（DPO）意见
● 如设有数据保护官（DPO）或类似职能，应提供其关于拟进行处理活动的意见、结论和建议。 ● 说明数据保护官（DPO）的意见已如何得到落实。 |
5.2 Views of data subjects or their representatives
5.2 数据主体或其代表的意见
● 在适当情况下，应提供数据主体（或其代表）关于拟进行处理活动的意见、结论和建议。 ● 说明其参与 DPIA 流程的情况，包括说明为何认为其参与不适当，或为何其无法参与。 |
6 CONCLUSION AND DECISION
Based on the assessment of risks and rights, the following decision has been taken:
6 结论与决定
基于对风险和权利的评估，已作出以下决定：
* REJECTED: The processing must be abandoned. * CONSULTATION: The processing will be consulted with the SA (see 6.2). * Yes, the data controller cannot find sufficient measures to reduce the risks to an acceptable level (i.e. the residual risks are still high) and does not wish to abandon the processing. * Yes, there is a national law requiring the controller to consult with, and/or obtain prior authorisation from, the SA in relation to processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health (Article 36(5) GDPR). * APPROVED: The processing may proceed (immediately). The residual risks are acceptable and there is no national law requiring consultation or prior authorisation from the Supervisory Authority (Article 36(5) GDPR). * CONDITIONALLY APPROVED: The processing may proceed only after the following conditions are met:
不予批准：必须放弃该处理活动。
● 条件 1：__________________________________________________ ● 条件 2：__________________________________________________ |
Optionally, justify the decision made:
可选择对所作决定进行说明：
上述模板填写时，可基于EDPB发布的DPIA说明文件进行填写，DPIA模板说明文件见链接：
