Podľa metodiky má metodológia pokryť nasledujúce oblasti:

"The GDPR sets out the minimum features of a DPIA (Article 35(7), and recitals 84 and 90):

- “a description of the envisaged processing operations and the purposes of the processing”;
- “an assessment of the necessity and proportionality of the processing”;
- “an assessment of the risks to the rights and freedoms of data subjects”;
- “the measures envisaged to:
    o “address the risks”;
    o “demonstrate compliance with this Regulation”.

Recital 90 of the GDPR outlines a number of components of the DPIA which overlap with well defined components of risk management (e.g. ISO 31000).

In risk management terms, a DPIA aims at “managing risks” to the rights and freedoms of natural persons, using the following three processes, by:
- establishing the context: “taking into account the nature, scope, context and purposes of the processing and the sources of the risk”;
- assessing the risks: “assess the particular likelihood and severity of the high risk”;
- treating the risks: “mitigating that risk” and “ensuring the protection of personal data”, and “demonstrating compliance with this Regulation”.