A DPIA, or data protection impact assessment, is a structured process required by Article 35 of the GDPR for identifying, assessing and reducing the risks that a planned processing of personal data poses to people’s rights and freedoms. It is mandatory whenever processing is likely to result in a high risk to individuals, and it must be completed before the processing begins.
Under the GDPR, the DPIA is a core tool of accountability and data protection by design. It forces the data controller to describe the processing, justify its necessity, analyze risks from the perspective of the people affected and document the measures that bring those risks down to an acceptable level.
When a DPIA is required under the GDPR
A DPIA is required when processing is likely to result in a high risk to the rights and freedoms of natural persons, particularly when new technologies are used. Article 35(3) names three situations in which a DPIA is always required, and supervisory authorities publish national lists of further processing types that need one.
| Situation | What it covers | Example |
|---|---|---|
| Systematic and extensive evaluation | Profiling or automated decisions with legal or similarly significant effects | Automated credit scoring |
| Large-scale special category data | Health, biometric, genetic or criminal offense data at scale | A hospital patient records platform |
| Systematic monitoring of public areas | Large-scale observation of publicly accessible places | City-wide video surveillance |
European guidance adds nine criteria that indicate high risk, including evaluation or scoring, sensitive data, large scale, matching of datasets, vulnerable data subjects and innovative technology. As a working rule, processing that meets two or more criteria usually requires a DPIA, although a single criterion can be enough in some cases.
| Criterion | Example in practice |
|---|---|
| Evaluation or scoring | Behavioral profiling for marketing segments |
| Automated decisions with significant effect | Automatic rejection of loan applications |
| Systematic monitoring | Employee activity tracking software |
| Sensitive or highly personal data | Health app data or location history |
| Large-scale processing | National customer database |
| Matching or combining datasets | Merging loyalty data with purchased data |
| Vulnerable data subjects | Children, patients or employees |
| Innovative technology | Facial recognition or new AI systems |
| Processing that prevents exercising a right | Screening that blocks access to a service |
What a DPIA must contain
Article 35(7) sets out the minimum content of a DPIA. The format is not prescribed, so organizations use templates from supervisory authorities or their own methods, but every assessment must cover four elements.
- A systematic description of the processing operations, purposes and, where applicable, the legitimate interest pursued.
- An assessment of necessity and proportionality in relation to the purposes.
- An assessment of the risks to the rights and freedoms of data subjects.
- The measures envisaged to address the risks, including safeguards and security measures.
Risk is assessed from the perspective of the individuals, not the organization. A DPIA evaluates the likelihood and severity of harms such as discrimination, identity theft, financial loss, reputational damage, loss of confidentiality or loss of control over personal data.
How a DPIA is carried out
A DPIA follows a repeatable workflow that starts early in a project and continues for as long as the processing runs. The controller is responsible, but must seek the advice of the data protection officer where one is designated and, where appropriate, the views of data subjects or their representatives.
| Stage | Main activity | Output |
|---|---|---|
| Screening | Check the processing against high-risk criteria | Decision whether a DPIA is needed |
| Description | Map data flows, systems, recipients and retention | Processing description |
| Necessity test | Review legal basis, minimization and proportionality | Justification of the design |
| Risk analysis | Rate likelihood and severity of each risk | Risk register |
| Mitigation | Define technical and organizational measures | Residual risk rating |
| Sign-off and review | Approve, record DPO advice, schedule reviews | Approved and maintained DPIA |
If the residual risk remains high after mitigation, Article 36 requires prior consultation with the supervisory authority before processing starts. The authority generally responds within eight weeks, extendable by six weeks for complex cases.
DPIA compared with related GDPR assessments
A DPIA is often confused with other assessments that serve different purposes. Clear distinctions help avoid both duplicate work and missing assessments.
| Assessment | Purpose | When it is used |
|---|---|---|
| DPIA | Assess high risks to individuals | Before high-risk processing begins |
| Legitimate interest assessment | Justify legitimate interest as a legal basis | Whenever that legal basis is relied on |
| Transfer impact assessment | Evaluate protection in a third country | Before transfers using standard clauses |
| Privacy impact assessment | General privacy risk review | Common outside the GDPR or as internal practice |
| Security risk assessment | Protect systems and information assets | Information security management |
Common DPIA mistakes
The most damaging mistake is treating the DPIA as a paperwork exercise completed after launch. An assessment written once the system is built cannot influence design choices, which defeats its purpose and fails the requirement to assess prior to processing.
- Assessing risks to the company instead of risks to individuals.
- Skipping the necessity test and describing only security measures.
- Never updating the DPIA after changes in purpose, data or technology.
- Ignoring processors and sub-processors in data flow descriptions.
Failing to carry out a required DPIA can lead to administrative fines under Article 83(4) of up to 10 million euros or 2 percent of worldwide annual turnover, whichever is higher.
In everyday language
A DPIA is a safety check for personal data, done before a new project starts. An organization asks what could go wrong for the people whose information it plans to use. Then it decides how to prevent those problems.
It is similar to an architect checking fire safety before building a house. Fixing a missing fire exit on paper is easy. Fixing it after the house is built is hard. Thinking about privacy risks early makes the final system safer and cheaper to correct.
Seen in the real world
A mid-sized logistics company plans to install in-cab cameras with driver fatigue detection across its fleet of 400 trucks. The system analyzes facial movements in real time and stores short clips when it detects signs of drowsiness. Screening shows several high-risk criteria: systematic monitoring of employees, biometric-like analysis and innovative technology, so a DPIA is required.
The DPIA team, advised by the data protection officer and employee representatives, decides that clips are kept for 30 days instead of a year, that only safety managers can view them and that continuous recording is replaced by event-triggered clips. With these measures, the residual risk is rated acceptable, the processing launches without prior consultation and the DPIA is scheduled for annual review.