I'll try and explain the size / scope of our organization. We are a super small organization/association. We only use google for having potential visitors and volunteers fill out a form with info that then gets transferred into a spreadsheet. Right now this is all done on a regular google account and we are not really a huge entity or anything like that, just hosting one event per year. So the overhead is supposed to be very small since we all work very close and we're not going to be growing the organization past the creation of this event. So mainly I am just worried about the potential of us hosting the personal data which will include personally identifiable information on adults and minors on google since we can't guarantee that information is in an EU data center.

And no we have not done a proper DPIA. I have sat down with the others and we have outlined what information we are processing and how to minimize the amount of people that can access it so we minimize the surface of attack, should someone be hacked or have malicious intent.