A Data Protection Impact Assessment (DPIA) is a legally required process for assessing and mitigating risks associated with the processing of personal data. Under Article 35 of the General Data Protection Regulation (GDPR), the controller must carry out a DPIA where a planned processing operation is likely to result in a high risk to the rights and freedoms of natural persons. The aim is to identify data protection risks at an early stage and establish appropriate safeguards.
When is a Data Protection Impact Assessment required?
Under Article 35(1) GDPR, a Data Protection Impact Assessment is required where a planned processing operation involving personal data is likely to result in a high risk to the rights and freedoms of data subjects, taking into account its nature, scope, context and purposes.
Article 35(3) GDPR identifies, in particular, the following cases in which a DPIA must be carried out:
- Automated evaluations and profiling: Systematic and extensive evaluations of personal aspects based on automated processing, which serve as the basis for decisions producing legal effects or similarly significant effects.
- Large-scale processing of sensitive data: Large-scale processing of special categories of personal data under Article 9 GDPR or data relating to criminal convictions and offences under Article 10 GDPR.
- Systematic monitoring: Systematic and extensive monitoring of publicly accessible areas, for example through large-scale video surveillance.
In addition, data protection supervisory authorities publish so-called lists of processing operations for which a DPIA is mandatory, pursuant to Article 35(4) GDPR.
Even if a processing operation is not expressly included on such a list, the controller must assess whether a DPIA is required in light of the specific risks involved. The decisive factor is the likely risk to the rights and freedoms of data subjects.
Before introducing new processing operations, companies should use a documented threshold assessment to determine whether a Data Protection Impact Assessment is required. This should take into account, in particular, the nature of the data processed, the scope of the processing, the technologies used and the potential effects on data subjects.
What is the purpose of a Data Protection Impact Assessment?
A Data Protection Impact Assessment is intended to systematically examine risks to data subjects before data processing begins. It aims to prevent new procedures or technologies from being introduced without adequately considering their potential impact on the protection of personal data.
The assessment does not focus solely on technical security risks. A DPIA also considers potential adverse effects on the rights and freedoms of data subjects, for example through unlawful surveillance, discrimination or loss of control over personal information.
A DPIA helps the controller assess whether processing is necessary and proportionate and determine appropriate safeguards. It is therefore an important instrument for meeting the accountability requirements under data protection law.
How is a Data Protection Impact Assessment carried out?
A Data Protection Impact Assessment must be carried out before the relevant data processing begins. Article 35(7) GDPR specifies the minimum elements that must be taken into account.
A DPIA generally involves the following steps:
- Description of the processing: A systematic description of the planned processing operations, their purposes and the personal data concerned.
- Assessment of necessity and proportionality: An examination of whether the processing is necessary for the intended purpose and complies with data protection requirements.
- Risk assessment: Identification and assessment of risks to the rights and freedoms of data subjects. This takes into account, in particular, the likelihood of those risks occurring and their potential impact.
- Definition of safeguards: Determination of appropriate technical and organisational measures to reduce the identified risks.
- Documentation and review: Clear documentation of the findings and review of the processing, particularly where the associated risks change.
Safeguards may include, for example, encryption of personal data, restrictions on access rights or pseudonymisation.
Where appropriate, the controller must also seek the views of data subjects or their representatives on the intended processing, in accordance with Article 35(9) GDPR. In doing so, the protection of commercial interests and the security of processing must be taken into account.
The DPIA must be documented in a comprehensible manner. It is not a one-off formality: it must be reviewed whenever relevant changes occur in the processing or the associated risks.
Who is responsible for the Data Protection Impact Assessment?
Responsibility for carrying out a Data Protection Impact Assessment lies with the controller within the meaning of Article 4(7) GDPR. The controller must assess whether a DPIA is required, evaluate the risks and establish appropriate safeguards.
Where a data protection officer has been appointed, the controller must seek their advice when carrying out the DPIA, pursuant to Article 35(2) GDPR. The data protection officer provides advice in particular on the assessment of data protection risks and monitors the performance of the DPIA under Article 39(1)(c) GDPR.
External service providers may also contribute to preparing a DPIA. However, responsibility under data protection law remains with the controller. Processors must support the controller in carrying out the assessment as part of their statutory obligations.
What happens if a Data Protection Impact Assessment identifies high risks?
If the Data Protection Impact Assessment identifies high risks to the rights and freedoms of data subjects, the controller must establish appropriate measures to mitigate those risks.
These may include additional security measures, restrictions on the personal data processed or changes to the planned processing procedure. The controller must then assess which risks remain despite these measures.
If the high risk cannot be sufficiently mitigated by the planned measures, the controller must consult the competent data protection supervisory authority before commencing the processing, in accordance with Article 36 GDPR.
The supervisory authority reviews the planned processing and may issue recommendations or exercise its statutory powers. A Data Protection Impact Assessment does not, however, replace the need for an appropriate legal basis or compliance with the other requirements of data protection law.
Practical example: Data Protection Impact Assessment when introducing an AI system
A company plans to introduce an AI-powered system for the automated assessment of job applications. The system analyses CVs, qualifications and other applicant data and generates suitability assessments. On the basis of these assessments, applicants may automatically be excluded from further stages of the selection process.
Since the planned processing involves the systematic and extensive automated evaluation of personal aspects, and the resulting decisions have significant effects on applicants' employment opportunities, the company must carry out a Data Protection Impact Assessment before introducing the system, pursuant to Article 35(3)(a) GDPR.
In particular, the company examines the risks of inaccurate assessments, potential discrimination and unauthorised access to applicant data. To mitigate these risks, it establishes appropriate measures, including a review of the assessment criteria, access restrictions and effective human oversight.
The findings are documented and the data protection officer is involved in the assessment. The company also separately examines whether the planned processing has an appropriate legal basis and complies with the requirements governing automated individual decision-making under Article 22 GDPR. A DPIA alone does not authorise the use of the system.
legal data assessment: Companies must assess whether a Data Protection Impact Assessment is required before introducing high-risk data processing activities. Early risk assessment is particularly important when introducing new technologies, automated evaluation systems and large-scale data analytics. A carefully documented DPIA provides transparency about existing risks and enables appropriate safeguards to be implemented in good time.
Legal bases
The key provisions are Article 35 GDPR on Data Protection Impact Assessments and Article 36 GDPR on prior consultation with the supervisory authority. Other relevant provisions include Article 5(2) GDPR on the accountability principle, Articles 24 and 25 GDPR on the controller's obligations and data protection by design, Article 28(3)(f) GDPR on support provided by processors, and Articles 32 and 39(1)(c) GDPR on security measures and the tasks of the data protection officer.
Frequently asked questions about Data Protection Impact Assessments
What does DPIA mean?
DPIA stands for Data Protection Impact Assessment. It refers to the systematic assessment of risks that a planned processing operation involving personal data may pose to the rights and freedoms of natural persons.
When must a Data Protection Impact Assessment be carried out?
A DPIA must be carried out before processing begins if the processing is likely to result in a high risk to the rights and freedoms of data subjects. The relevant requirements are set out in particular in Article 35 GDPR and the lists published by data protection supervisory authorities.
Does every company have to carry out a Data Protection Impact Assessment?
No. The obligation does not depend on the size of the company, but on the risks associated with the particular processing operation. Small companies must also carry out a DPIA if the statutory requirements are met.
Does a Data Protection Impact Assessment need to be updated regularly?
A DPIA must be reviewed where necessary, particularly if the risks associated with the processing change. There is no general statutory obligation to update it at fixed intervals.
What are the consequences of failing to carry out a Data Protection Impact Assessment?
Failure to carry out a legally required DPIA constitutes an infringement of the GDPR. The competent data protection supervisory authority may order remedial measures and, where the statutory conditions are met, impose administrative fines under Article 83(4) GDPR.
Related terms.
Privacy by design Privacy by design means building data protection into the technical and organisational design of systems, products and processes from the outset. Art. 25(1) GDPR Artificial intelligence and data protection When artificial intelligence is used, the GDPR applies whenever personal data is processed in training, in the input or in the output. Art. 6 GDPR Video surveillance Video surveillance is the monitoring of rooms or areas using optical-electronic equipment, and it is permitted under data protection law if it is necessary and proportionate. Art. 6(1)(f) GDPR 