GDPR Data Protection Impact Assessment (DPIA)

A Data Protection Impact Assessment (DPIA) is a process required by Article

35 GDPR to evaluate the risks of a planned data processing activity to the rights and freedoms of individuals. It must be carried out before processing begins and covers the description of processing operations, the assessment of necessity and proportionality, a risk analysis and the identification of safeguards to mitigate those risks.

Article 35(3) GDPR requires a DPIA for: systematic and extensive evaluation of personal aspects based on automated processing including profiling, large-scale processing of special categories of data (Article 9) or criminal data (Article 10), and systematic monitoring of publicly accessible areas on a large scale. National supervisory authorities also publish blacklists of processing operations that always require a DPIA.

The threshold analysis uses the

9 criteria published by the Article

29 Working Party (WP 248) to determine whether a DPIA is required. These include: evaluation or scoring, automated decision-making with legal effects, systematic monitoring, processing of sensitive data, large-scale processing, matching or combining datasets, data concerning vulnerable persons, innovative use of technology, and processing that prevents data subjects from exercising their rights. When two or more criteria apply, a DPIA is generally required.

A DPIA follows four main steps: 1) Describe the processing — purpose, legal basis, data categories and recipients. 2) Assess necessity and proportionality — whether the processing is the least intrusive way to achieve the purpose. 3) Identify and evaluate risks — likelihood and severity of harm to data subjects. 4) Define mitigation measures — technical and organisational measures (TOMs) to reduce risks to an acceptable level. The results are documented and submitted to the Data Protection Officer for review.

The data controller (typically senior management) is responsible for conducting the DPIA. The Data Protection Officer (DPO) must be consulted under Article 35(2) GDPR and provides advice, but does not carry out the DPIA themselves. Where joint controllership exists (Article

26 GDPR), responsibilities should be contractually defined.

Under Article

36 GDPR, prior consultation with the supervisory authority is required when the DPIA concludes that high residual risk remains despite all planned safeguards. The authority has up to eight weeks to provide recommendations or to prohibit the processing.

AI systems processing personal data frequently require both a GDPR DPIA and a conformity assessment under the EU AI Act. High-risk AI systems listed in Annex III of the AI Act — such as credit scoring, biometric identification or recruitment tools — typically trigger the DPIA obligation because they involve systematic profiling or automated decisions with significant effects on individuals.