Data protection impact assessment (DPIA)

A data protection impact assessment (DPIA) is required before processing that is likely to result in a high risk for people (GDPR Article 35). It describes the processing, shows it is necessary and proportionate, rates the risks for people and records the measures that reduce them. The Assessments page holds the screening of each activity and the assessments themselves.

#Screen each activity

For each activity of your processing register, choose Screen and tick the criteria that apply. They are the nine criteria of the European Data Protection Board:

• Evaluation or scoring, including profiling.
• Automated decisions with a legal or similarly significant effect.
• Systematic monitoring of people.
• Sensitive or highly personal data.
• Large scale.
• Matching or combining datasets.
• Vulnerable people, such as children, employees or patients.
• Innovative technology, such as artificial intelligence.
• Processing that blocks a right or access to a service.

Criteria your records point to are ticked for you to confirm: sensitive or financial data, employees and applicants, analytics, advertising or AI tools, optional cookies on your banner, and the usual criteria of the activity template you started from. Say about how many people are concerned: over 100,000 suggests the large-scale criterion, and the answer also fills the DPIA. Two criteria or more usually mean a DPIA is required; one means you should consider it. You can record your own decision and the reason, for example when you decide a DPIA is not needed despite the criteria.

#Run the assessment

Choose Start DPIA. The assessment opens with what your records already say, and every answer taken from them is marked Suggested until you change it:

• purposes, data, people, vendors, retention, legal basis and transfers, with the status of each transfer impact assessment;
• the measures Privacyboard can see in place, such as reviewed data processing agreements, retention periods, the request form, the cookie banner and the breach register;
• the planned measures, listed from what is still missing (a DPA to review, MFA or backups not in place, a retention period to set, a TIA to complete), each with a date three months ahead;
• the three risks, drafted from your kinds of data and your tools: the impacts on people, how it could happen (naming your vendors), the risk sources, the measures that reduce it, and a suggested severity. Incidents already recorded about these tools are listed. The likelihood is yours to judge.

Check and complete each part:

1. Context: what the processing is, the data, the people, the recipients and how data is collected, stored and deleted.
2. Necessity and proportionality: legal basis, why each kind of data is needed, retention, accuracy, how people are informed and exercise their rights, processors and transfers.
3. Security measures: what is in place, and what is planned with a date.
4. Risks: for illegitimate access, unwanted change and disappearance of the data, describe the impact on people and how it could happen, then rate severity and likelihood before and after your measures, from Negligible to Maximum. A risk is high when both are significant or more.
5. Conclusion: whether the residual risk is acceptable, the opinion of your data protection officer if you have one, who prepared it and the review date.

When the residual risk stays high, the conclusion must be to consult your supervisory authority before starting the processing (Article 36). Mark as completed is available once every part is answered. Completed assessments are dated and should be reviewed at least every year, or when the processing changes: the Overview tells you when a review is due.

#When your records change

If you change an activity, a vendor or your security answers after starting a DPIA, the assessment shows Your records changed and offers to update the answers you left as suggested. Answers you wrote or edited are never replaced. An assessment whose activities were all removed from the register stays as it was.

#Export

Each assessment has a PDF button. Completed and draft assessments are also included in the evidence pack.

#FAQ

#Is a DPIA required for every activity?

No. It is required when processing is likely to result in a high risk for people. Screening each activity records why you decided one was or was not needed.

#Can I start a DPIA without screening first?

Screening comes first because it documents the decision. Once an activity is screened as needing a DPIA, or meets one criterion, Start DPIA appears.

#Can I trust the suggested answers?

They are a starting point drawn from your own records and the vendors' published documents, not a judgement on your situation. Read each one against how the processing really works, and change it when it does not fit: the Suggested mark disappears once you do.

#Does completing a DPIA make the processing compliant?

No. It records your own assessment and the measures you chose. It is not legal advice or a certification.