# Large-Scale Monitoring PIA Template

## 1. Organisation Information

| Field | Value |
|-------|-------|
| Organisation name | |
| Industry sector | |
| DPO name | |
| Assessment date | |

## 2. Monitoring System Inventory

| System ID | Name | Type | Purpose | Coverage Area | Subject Count | Continuous | Retention |
|---|---|---|---|---|---|---|---|
| | | CCTV / Email / Internet / Keystroke / GPS / Badge / Analytics / Facial Recognition | | Public / Private / Workplace | | Yes / No | hours |
| | | | | | | | |

## 3. DPIA Trigger Assessment

| System | Art. 35(3)(c) Publicly Accessible | WP248 C3 Systematic | WP248 C4 Large Scale | WP248 C5 Special Category | WP248 C8 Innovative Tech | DPIA Mandatory |
|--------|---|---|---|---|---|---|
| | Yes / No | Yes / No | Yes / No | Yes / No | Yes / No | Yes / No |
| | | | | | | |

## 4. Necessity and Proportionality

| System | Specific Purpose | Alternative Measures Assessed | Less Intrusive Option Available | Proportionality Conclusion |
|--------|-----------------|------------------------------|-------------------------------|---------------------------|
| | | Yes / No | Yes / No | Proportionate / Disproportionate |
| | | | | |

## 5. CCTV Compliance (EDPB Guidelines 3/2019)

- [ ] Lawful basis documented
- [ ] Signage at boundary of monitored area
- [ ] Signage includes: camera pictogram, controller identity, purpose, reference to full notice
- [ ] Full privacy notice accessible (QR code / website / reception)
- [ ] Retention default <=72 hours (or justified if longer)
- [ ] Access controls for footage viewing documented
- [ ] Privacy masking for non-relevant areas
- [ ] Facial recognition: explicit consent or substantial public interest basis

## 6. Employee Monitoring Compliance (Barbulescu Criteria)

| Criterion | Assessment |
|-----------|-----------|
| Prior notification to employees | Yes / No |
| Extent of monitoring documented | |
| Legitimate reasons documented | |
| Less intrusive alternatives assessed | Yes / No |
| Consequences for employee documented | |
| Adequate safeguards in place | Yes / No |
| Works council / representatives consulted | Yes / No / N/A |
| Employee monitoring policy distributed | Yes / No |

## 7. Transparency Measures

| System | Signage | Privacy Notice | Employee Policy | Data Subject Rights Process |
|--------|---------|---------------|-----------------|---------------------------|
| | Yes / No | Yes / No | Yes / No / N/A | Yes / No |
| | | | | |

## 8. Retention and Deletion

| System | Retention Period | Justification | Automated Deletion | Exception Process |
|--------|-----------------|---------------|-------------------|------------------|
| | | | Yes / No | Yes / No |
| | | | | |

## 9. Risk Assessment

| System | Risk Score | Risk Level | Key Risk Factors |
|--------|-----------|------------|-----------------|
| | | Low / Medium / High / Critical | |
| | | | |

## 10. Mitigation Measures

| Risk | Mitigation | Status | Owner |
|------|-----------|--------|-------|
| | | | |
| | | | |

## 11. Sign-Off

| Role | Name | Date | Signature |
|------|------|------|-----------|
| DPO | | | |
| Head of Security | | | |
| HR Director | | | |
| Legal Counsel | | | |