GDPR mandates that a PIA includes the following :

Systematic description of the contemplated processing operations and the purposes of the processing, including, where applicable, the legitimate interest

pursued by the controller

Assessment of the necessity and proportionality of the processing operations in relation to the purposes

Assessment of the risks to the rights and freedoms of data subjects

Measures to address the risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data and to demonstrate compliance with the GDPR$,$ taking into account the rights and legitimate interests of data subjects and other persons concerned.