Some data processing is risky enough that the GDPR requires you to assess it before you start. That assessment is the Data Protection Impact Assessment, or DPIA. Skipping one when it is required is itself a breach, and a completed DPIA is one of the first things a regulator asks for when something goes wrong. This guide explains when a DPIA is needed, what it must contain and how to run one without turning it into a paper exercise.
What a DPIA is
A DPIA is a structured assessment of how a planned processing activity affects the privacy and rights of the people whose data you handle, and of the measures you will take to reduce that impact. It is required by Article 35 of the GDPR whenever processing is likely to result in a high risk to individuals. Done properly, it is also a practical design tool that surfaces problems while they are still cheap to fix.
When a DPIA is required
A DPIA is mandatory for processing likely to be high risk, and the GDPR singles out three situations in particular: systematic and extensive profiling that produces significant effects on people; large-scale processing of special-category data such as health or biometric information; and systematic large-scale monitoring of publicly accessible areas. National regulators also publish lists of operations that always require one. When in doubt, a short screening assessment helps you decide.
What the assessment must contain
A DPIA must describe the processing and its purposes, assess whether it is necessary and proportionate to those purposes, identify and evaluate the risks to individuals, and set out the measures you will take to address those risks. It should involve your data protection officer where you have one, and in appropriate cases seek the views of the people affected. It is a living document, revisited when the processing changes.
Practical example: rolling out workforce analytics
A company plans to introduce software that monitors employee productivity across its systems. This is systematic monitoring of individuals and likely high risk, so a DPIA is needed before launch. The assessment might reveal that the same goal can be met with aggregated rather than individual data, reducing intrusion. Documenting that choice both lowers the risk and demonstrates accountability if the regulator ever asks.
Common mistakes companies make
Typical failings include starting the processing first and writing the DPIA afterwards, treating it as a form to complete rather than a genuine risk assessment, ignoring less intrusive alternatives, and failing to act on the risks the DPIA identifies. Another is forgetting the follow-up step: where a DPIA shows a high residual risk that you cannot mitigate, you must consult the supervisory authority before proceeding.
Recommended actions
Build a quick screening question into any new project that involves personal data, so DPIAs are triggered at the right time. Run the assessment early, while the design can still change, and involve your DPO and, where relevant, the people affected. Record the risks and your mitigations, act on them, and revisit the DPIA when the processing evolves. Keep the document, because it is your evidence of accountability.
Frequently asked questions
When is a DPIA legally required?
When processing is likely to result in a high risk to individuals, and in particular for large-scale profiling with significant effects, large-scale special-category data, or systematic large-scale monitoring of public areas. Regulators also publish mandatory lists.
What happens if the DPIA shows a high risk we cannot reduce?
If a significant residual risk remains after mitigation, you must consult the supervisory authority before starting the processing. They can give advice or, in serious cases, order changes.
Who should carry out the DPIA?
The controller is responsible, but the data protection officer should be involved where one exists, and input from IT, security and the business is valuable. For higher-risk cases, the views of affected individuals may also be sought.
Conclusion
A DPIA is both a legal requirement for higher-risk processing and a practical way to design privacy in from the start. Getting the timing and substance right protects individuals and shields your business from avoidable enforcement. Lawgent helps businesses identify when a DPIA is needed, run assessments that stand up to scrutiny and act on what they find. Contact us to strengthen your data protection processes.
