EMZETT.
Login

Emzett Wiki

Data protection impact assessment (DPIA): When and how

Properties1
tagsglossar, recht, datenschutz

2 min read

Data protection impact assessment (DPIA): When and how

In short: For processing with a high risk to data subjects a DPIA must be carried out in advance: describe risks, assess them and reduce them with measures.

In more detail: The GDPR (Art. 35) requires a data protection impact assessment when processing is likely to result in a high risk to the rights and freedoms of natural persons, for example because of new technologies, scale or sensitivity. It is mandatory before processing starts. This is general information and not legal advice; laws change and individual cases can differ. For concrete problems counselling (consumer advice, lawyer, data protection authority) helps.

In Depth

When is it necessary?

Typical cases (Art. 35(3) GDPR and lists of the supervisory authorities):

  • Extensive profiling with significant decisions (scoring).
  • Extensive processing of special categories (health, biometric data, political opinion).
  • Systematic extensive monitoring of public areas (video surveillance).
  • New technologies with high risk (AI decision systems, comprehensive tracking solutions).
  • The supervisory authorities publish must-lists on whether certain processing requires a DPIA. Small businesses are often not affected but should check and document (“threshold analysis”).

Procedure

  1. Describe the processing: data, purposes, parties, data flows, storage period.
  2. Justify necessity and proportionality: legal basis, data minimisation.
  3. Identify risks for data subjects (discrimination, identity theft, loss of control, financial damage) and assess by likelihood and severity.
  4. Define remedial measures (encryption, pseudonymisation, access rights, deletion periods, transparency).
  5. Assess residual risk. If it remains high, the supervisory authority must be consulted beforehand (Art. 36).
  6. Document and review regularly. Involve the data protection officer (if any) and, where sensible, data subjects or representatives.

Aids and practice

Templates and tools are offered by supervisory authorities, BfDI, CNIL (PIA tool), the Standard Data Protection Model (SDM) and associations. The DPIA is an ongoing process, not a compulsory exercise: re-check when the project changes. For small projects (for example a club app) a short risk overview along the same pattern often pays off. It links with the record of processing activities and TOMs.

Typical mistakes

Starting too late (after processing begins), wording too generally, assessing risks only for the company instead of data subjects, not implementing measures, not keeping the result current.

See also: Record of processing activities, GDPR principles, Data breach and notification duty, Risk analysis