# Federated Learning GDPR Compliance Assessment Template

## Organisation: Cerebrum AI Labs

---

| Field | Value |
|-------|-------|
| FL System Name | |
| Pattern | Cross-Device / Cross-Silo / Vertical |
| Participants | ___ organisations/devices |
| Aggregation Protocol | Plaintext / Secure Aggregation / HE / TEE |
| Differential Privacy | None / Local / Central — Epsilon: ___ |
| Data Sensitivity | General / Special Category / Highly Sensitive |
| Cross-Border | Yes / No |
| Assessment Date | |

---

## CONTROLLER/PROCESSOR DETERMINATION

| Entity | Role | Art. 26/28 Agreement? |
|--------|------|----------------------|
| | Independent Controller / Joint Controller / Processor | Yes / No |
| | | Yes / No |
| Aggregator | Controller / Processor | Yes / No |

## PRIVACY MEASURES

| Measure | Implemented? | Details |
|---------|-------------|---------|
| Secure aggregation | Yes / No | Protocol: |
| Differential privacy | Yes / No | Type: ___ Epsilon: ___ |
| Gradient clipping | Yes / No | Norm: |
| Communication encryption | Yes / No | |

## COMPLIANCE CHECKLIST

| Requirement | Met? |
|-------------|------|
| Lawful basis per participant | Yes / No |
| Privacy notice updated | Yes / No |
| Joint controller agreement (if applicable) | Yes / No |
| DPA with processor (if applicable) | Yes / No |
| DPIA conducted | Yes / No |
| Transfer safeguards (if cross-border) | Yes / No |
| Data subject rights mechanism | Yes / No |

## RISK ASSESSMENT

| Risk | Level | Mitigation |
|------|-------|------------|
| Gradient leakage | Low / Medium / High | |
| Model memorization | Low / Medium / High | |
| Transfer risk | Low / Medium / High / N/A | |

## APPROVAL

| Role | Name | Date |
|------|------|------|
| System Owner | | |
| DPO | | |

**Next Review**: _______________