WP29提出了以下标准，数据控制者可以使用这些标准来评估DPIA或执行DPIA的方法是否足够全面，以符合GDPR：
提供了对处理的系统描述（第35（7）（a）条）：
nature, scope, context and purposes of the processing are taken into account (recital 90);
考虑到处理的性质、范围、背景和目的（事实陈述90）；
personal data, recipients and period for which the personal data will be stored are recorded;
记录个人数据、收件人和个人数据的存储期限；
a functional description of the processing operation is provided;
提供处理操作的功能描述；
the assets on which personal data rely (hardware, software, networks, people, paper or paper transmission channels) are identified;
识别个人数据所依赖的资产（硬件、软件、网络、人员、纸张或纸张传输渠道）；
compliance with approved codes of conduct is taken into account (Article 35(8));
考虑遵守批准的行为准则（第35（8）条）；
necessity and proportionality are assessed (Article 35(7)(b)):
对必要性和相称性进行评估（第35条第（7）款（b）项）：
measures envisaged to comply with the Regulation are determined (Article 35(7)(d) and recital 90), taking into account:
考虑到以下因素，确定了为遵守该条例而设想的措施（第35（7）（d）条和序言90）：
measures contributing to the proportionality and the necessity of the processing on the basis of:
有助于相称性和处理必要性的措施，基于：
specified, explicit and legitimate purpose(s) (Article 5(1)(b));
具体、明确和合法的目的（第5条第（1）款（b）项）；
lawfulness of processing (Article 6);
处理的合法性（第6条）；
adequate, relevant and limited to what is necessary data (Article 5(1)(c));
充分、相关且仅限于必要的数据（第5条第（1）款（c）项）；
limited storage duration (Article 5(1)(e));
有限的储存期限（第5（1）（e）条）；
measures contributing to the rights of the data subjects:
有助于数据主体权利的措施：
information provided to the data subject (Articles 12, 13 and 14);
向数据主体提供的信息（第12、13和14条）；
right of access and to data portability (Articles 15 and 20);
访问权和数据可移植性（第15条和第20条）；
right to rectification and to erasure (Articles 16, 17 and 19);
更正和删除的权利（第16、17和19条）；
right to object and to restriction of processing (Article 18, 19 and 21);
反对和限制处理的权利（第18、19和21条）；
relationships with processors (Article 28);
与加工商的关系（第28条）；
safeguards surrounding international transfer(s) (Chapter V);
围绕国际转让的保障措施（第五章）；
prior consultation (Article 36).
事先协商（第36条）。
risks to the rights and freedoms of data subjects are managed (Article 35(7)(c)):
管理数据主体权利和自由的风险（第35（7）（c）条）：
origin, nature, particularity and severity of the risks are appreciated (cf. recital 84) or, more specifically, for each risk (illegitimate access, undesired modification, and disappearance of data) from the perspective of the data subjects:
从数据主体的角度了解风险的起源、性质、特殊性和严重性（参见事实陈述84），或者更具体地说，了解每种风险（非法访问、不期望的修改和数据丢失）：
risks sources are taken into account (recital 90);
考虑风险源（事实陈述90）；
potential impacts to the rights and freedoms of data subjects are identified in case of events including illegitimate access, undesired modification and disappearance of data;
在发生非法访问、不希望的修改和数据丢失等事件的情况下，确定对数据主体权利和自由的潜在影响；
threats that could lead to illegitimate access, undesired modification and disappearance of data are identified;
识别可能导致非法访问、意外修改和数据丢失的威胁；
likelihood and severity are estimated (recital 90);
估计可能性和严重性（事实陈述90）；
measures envisaged to treat those risks are determined (Article 35(7)(d) and recital 90);
确定了为应对这些风险而设想的措施（第35条第（7）款（d）项和事实陈述90）；
interested parties are involved:
涉及利益相关方：
the advice of the DPO is sought (Article 35(2));
征求DPO的意见（第35（2）条）；
the views of data subjects or their representatives are sought, where appropriate (Article 35(9)).
在适当的情况下，征求数据主体或其代表的意见（第35（9）条）。
