When do you need a DPIA? GDPR Article 35 with a small-business example

By the Privacyboard teamPublished 6 November 20269 min read

Short answer

A data protection impact assessment (DPIA) is required before any processing that is likely to result in a high risk to people's rights and freedoms (GDPR Article 35). Check it against the nine EDPB criteria and your regulator's list: in most cases, two criteria mean you need one. It must describe the processing, test necessity and proportionality, assess the risks and list the measures.

You need a data protection impact assessment (DPIA) before you start any processing of personal data that is "likely to result in a high risk" to people's rights and freedoms (GDPR Article 35). To decide, check the processing against the nine criteria of the European data protection authorities and against your national regulator's list. In most cases, two criteria or more mean a DPIA is required.

Most small businesses need very few DPIAs, and many need none. But the decision itself should be written down, activity by activity. This guide explains the test, walks through a worked example and lists what the assessment must contain. It is general information, not legal advice.

#What does Article 35 actually require?

Article 35(1) says that where a type of processing, "in particular using new technologies", is likely to result in a high risk, the controller shall carry out an assessment of its impact prior to the processing. A single assessment can cover a set of similar processing operations with similar high risks.

Article 35(3) names three cases where a DPIA is always required:

a systematic and extensive evaluation of people based on automated processing, including profiling, used for decisions with legal or similarly significant effects;
processing on a large scale of special categories of data (health, biometrics, religion and the others in Article 9) or of data about criminal convictions;
systematic monitoring of a publicly accessible area on a large scale, such as CCTV covering a street or a shopping centre.

These three are examples, not the full list. Each national supervisory authority must also publish a list of processing that requires a DPIA (Article 35(4)), and may publish a list of processing that does not.

#What are the nine criteria, and what is the two-criteria rule?

The EU's former Article 29 Working Party set out nine criteria in its DPIA guidelines (WP248 rev.01, last revised on 4 October 2017). The European Data Protection Board (EDPB) has endorsed these guidelines, and they remain the reference.

#	Criterion	Small-business example
1	Evaluation or scoring, including profiling and predicting	Scoring customers to predict who will cancel
2	Automated decisions with legal or similarly significant effect	Refusing credit or a contract with no human review
3	Systematic monitoring	Monitoring staff email or screens, tracking delivery drivers
4	Sensitive or highly personal data	Health, biometrics, financial data, location
5	Large scale	Data on a large share of a population or a region
6	Matching or combining datasets	Merging app data with data bought from a broker
7	Vulnerable people	Employees, children, patients, elderly people
8	Innovative use of technology	New AI tools, facial recognition, connected devices
9	Processing that prevents people from using a right, a service or a contract	Screening that decides who can open an account

The guidelines say that "in most cases, a data controller can consider that a processing meeting two criteria would require a DPIA to be carried out." This is a rule of thumb, not an automatic switch. One criterion can be enough when the risk is clearly high. And if you decide that two criteria do not make the processing high risk, you should write down why.

"Large scale" has no number in the GDPR. The guidelines ask you to consider the number of people, the volume and range of data, how long the processing lasts and its geographic reach.

#What do national lists add?

National lists turn the criteria into concrete cases. As of 6 November 2026, the list of France's CNIL contains 14 types of processing that always need a DPIA. They include:

systematic monitoring of employees' activity;
profiling or evaluating people for HR purposes, such as spotting "high potential" staff;
whistleblowing and professional alert systems;
profiling that combines data from external sources, such as data brokers or personalised online advertising;
large-scale processing of location data, such as a mobile app that collects geolocation;
health data processed by care providers, and biometric identification of vulnerable people.

The CNIL notes that its list is not exhaustive: processing that is not on it may still need a DPIA under the nine criteria. Every EU and EEA authority has its own list, so check the one where you are established.

#A worked example: a small online coaching business

Imagine a 12-person company that sells online fitness coaching to about 20,000 customers. Here are three of its activities, screened against the criteria.

1. Newsletter to customers. Names and email addresses, sent through an email tool. No criterion applies. No DPIA needed. The screening takes a minute and is recorded with the date.

2. Invoicing and payments. Billing details, handled by a payment provider. Financial data can count as "highly personal" (criterion 4), but this is routine processing that people expect, with a well-known provider. One criterion, low risk. The company records its decision not to run a DPIA and the reason.

3. New feature: personalised plans from wearable data. The app will import heart rate, sleep and weight data from customers' watches (health data, criterion 4), and an algorithm will score each customer's fitness to adjust the plan (evaluation or scoring, criterion 1). It also uses a new AI model (criterion 8). Three criteria. A DPIA is required, and it must be done before the feature launches.

The DPIA does not stop the project. It shapes it. In this example, the assessment might lead the company to:

ask for explicit consent for health data, separately from the terms of service (Article 9(2)(a));
import only the metrics the plan actually uses, not the full history from the watch;
delete the imported data when a customer cancels, and set a retention period for the rest;
check where the AI provider processes the data and sign a data processing agreement;
let customers see why their plan changed, and turn the feature off.

If, after these measures, the risk is still high, the company must consult its supervisory authority before going live (Article 36, see below).

#What must a DPIA contain?

Article 35(7) sets the minimum. A DPIA must contain at least:

A systematic description of the processing and its purposes, including the legitimate interest pursued where that is the legal basis.
An assessment of necessity and proportionality: is each piece of data needed for the purpose, and is there a less intrusive way?
An assessment of the risks to people's rights and freedoms.
The measures planned to address those risks: safeguards, security measures and ways to show compliance.

Two more steps come from the same article. If you have a data protection officer, you must seek their advice (Article 35(2)). And "where appropriate", you should seek the views of the people concerned or their representatives (Article 35(9)), for example through a short customer survey or by consulting staff representatives about an HR tool.

#Is there an official template?

The EDPB published a common DPIA template and an explainer on 14 April 2026, with a public consultation that ran until 9 June 2026. As of 6 November 2026, the EDPB page still lists it as version 1 and says it will be finalised after the consultation. Using it is not mandatory. Its sections follow the logic of Article 35: overview, systematic description, legal analysis, necessity and proportionality, risk assessment, involvement of the DPO and the people concerned, and a conclusion (proceed, proceed with conditions, consult the authority, or abandon).

#What happens if the risk is still high?

Under Article 36, if the DPIA shows that the processing would result in a high risk in the absence of measures to reduce it, you must consult your supervisory authority before starting. The authority has up to eight weeks to give written advice, which can be extended by six weeks for complex processing. It must tell you of any extension within one month.

In practice, most DPIAs end with measures that bring the residual risk down to an acceptable level, and no consultation is needed. The point is to write down how you got there.

#When should you review a DPIA?

Article 35(11) says you should review the processing against the DPIA "at least when there is a change of the risk". The WP248 guidelines go further and describe a DPIA as a continuous process that should be "regularly re-assessed". A new vendor, a new type of data, a new purpose or a security incident are all good reasons to reopen it.

Publishing a DPIA is not required by the GDPR. The guidelines suggest publishing at least a summary or the conclusion, which can help build trust, for example on a privacy center.

#Checklist: deciding whether you need a DPIA

List your processing activities in your record of processing activities.
For each activity, tick the nine criteria that apply.
Check your national regulator's list of processing that requires a DPIA.
Two criteria or more, or on the national list: plan a DPIA before the processing starts.
One criterion or none: record the decision, the date and the reason.
For each DPIA, cover the four parts of Article 35(7) and ask your DPO, if you have one.
If the residual risk stays high, consult your supervisory authority before starting.
Set a review trigger: any change of data, purpose, vendor or technology.

In Privacyboard, the Assessments page lets you screen each activity of your register against the nine criteria and, when needed, start a DPIA prefilled from your records. Screening is free; complete DPIAs are part of the paid plans.

#Is anything changing?

As of 6 November 2026, Article 35 is unchanged. The European Commission's "Digital Omnibus" proposal would create common EU-wide lists of processing that does and does not require a DPIA, plus a common template and methodology. The EDPB and the European Data Protection Supervisor welcomed the idea in their Joint Opinion 2/2026 of 10 February 2026, while objecting to the Commission being able to modify the EDPB's lists. It is a proposal, not law.

#FAQ

#Is a DPIA mandatory for every business?

No. It is required only for processing that is likely to result in a high risk. Many small businesses have no activity that needs one. What you should keep is a record of how you decided, activity by activity.

The WP248 guidelines say that processing checked by a supervisory authority before May 2018, whose conditions have not changed, does not need one. If the conditions or risks have changed since, and the processing is likely to be high risk, a DPIA should be carried out.

#Who should write the DPIA?

The controller is responsible, meaning the business that decides why and how the data is used. It can ask someone inside or outside the company to do the work, but stays accountable. In a small company, that is usually the founder or the person who owns the project, with input from IT, the vendor and the DPO if there is one. A processor should help by providing information about its service.

#Is a DPIA the same as a legitimate interests assessment?

No. A legitimate interests assessment checks whether you can use one legal basis. A DPIA looks at the overall risk of a processing operation to people, whatever the legal basis. A high-risk activity based on legitimate interests may need both.

#Can one DPIA cover several activities?

Yes. Article 35(1) allows a single assessment for a set of similar processing operations with similar high risks, for example the same CCTV setup in several shops.

#What is an AIPD?

It is the French name for a DPIA: "analyse d'impact relative à la protection des données". It is the term the CNIL uses.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to hello@privacyboard.io.