Data protection impact assessment (DPIA)

GDPR Art. 35(1) requires a DPIA before processing that, taking into account its nature, scope, context and purposes, and in particular the use of new technologies, is likely to result in a high risk to the rights and freedoms of natural persons. Art. 35(3) lists three cases where a DPIA is always required: systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; large-scale processing of special categories (Art. 9) or criminal-offence data (Art. 10); and systematic monitoring of a publicly accessible area on a large scale. Under Art. 35(4) each supervisory authority publishes a list of processing types that always require a DPIA, and Datatilsynet's eight-item list covers, for example, biometric identification, genetic data, location data and new technologies when combined with at least one further WP248 criterion, large-scale profiling, and processing where a breach could directly affect a person's physical health or safety.

For everything else, the Article 29 Working Party guidelines WP248 rev.01, endorsed by the EDPB, give nine criteria: evaluation or scoring, automated decision-making with legal or similar effect, systematic monitoring, sensitive or highly personal data, large scale, matching or combining datasets, data concerning vulnerable subjects (employees, children, patients), innovative use of technology, and processing that prevents people from exercising a right or using a service. As a rule of thumb, processing meeting two or more criteria requires a DPIA; if the controller concludes otherwise, the reasoning should be documented.

Art. 35(7) sets the minimum content: a systematic description of the processing and purposes, including any legitimate interest; an assessment of necessity and proportionality in relation to the purposes; an assessment of the risks to data subjects; and the measures envisaged to address those risks, including safeguards and security mechanisms. The controller must seek the advice of the DPO where one is designated (Art. 35(2)) and, where appropriate, the views of data subjects or their representatives (Art. 35(9)). A single DPIA may cover a set of similar processing operations, and it must be reviewed when the risk changes (Art. 35(11)).

If residual risk remains high after mitigation, Art. 36 requires prior consultation of the supervisory authority before processing starts; the authority has eight weeks to give written advice, extendable by six weeks for complex cases, and may use its Art. 58 powers, including a ban. The key conceptual difference from an ISO 27005 or NIS2 risk assessment is the object of harm: a DPIA assesses risk to data subjects (discrimination, loss of confidentiality, chilling effects, financial loss), not to the organisation's assets. Common failure modes are performing the DPIA after procurement has fixed the design, treating it as a one-off document rather than a living assessment, and copying generic security controls without linking them to specific identified risks.