GDPR DPIAs: when is a Data Protection Impact Assessment legally required?

A Data Protection Impact Assessment (DPIA) is a structured documented analysis of a processing activity that is "likely to result in a high risk to the rights and freedoms of natural persons" (GDPR Art. 35). It identifies the risk, the safeguards in place, residual risk, and — if residual risk remains high — triggers a mandatory prior consultation with the supervisory authority before processing begins. Skipping a required DPIA is itself a sanctionable breach.

Article 35(3) lists three automatic triggers; the EDPB Guidelines (WP248 rev.01) and each national authority publish blacklists of additional triggers.

• Systematic and extensive automated decision-making with legal or similarly significant effects (e.g. credit scoring, automated hiring screens)
• Large-scale processing of special-category data (Art. 9) or criminal-conviction data (Art. 10) — health, biometric, religion, political opinion, sexual life, etc.
• Systematic monitoring of publicly accessible areas on a large scale (CCTV networks, footfall analytics, smart-city sensors)
• AEPD (Spain) adds: any solvency, fraud or risk-scoring system; any biometric identification; any large-scale tracking of employees
• CNIL (France) and AP (NL) publish similar lists — always consult your lead supervisory authority’s blacklist

EDPB WP248 says you should also do a DPIA when at least two of nine criteria apply. SMEs almost always hit two without realising.

• Evaluation or scoring (including profiling)
• Automated decision-making with legal or significant effect
• Systematic monitoring
• Sensitive data or data of a highly personal nature
• Data processed on a large scale
• Matching or combining datasets (e.g. CRM + marketing analytics)
• Data concerning vulnerable data subjects (employees, children, patients)
• Innovative use or applying new technological/organisational solutions (AI, biometric, IoT)
• Processing prevents data subjects exercising a right or using a service

A DPIA that does not contain all four elements below is not a DPIA in the eyes of an inspector. We have seen "DPIAs" rejected by AEPD because they were a one-page risk register.

• Systematic description of the envisaged processing operations and purposes (including the legitimate interest if applicable)
• Assessment of the necessity and proportionality of the operations in relation to the purposes
• Assessment of the risks to the rights and freedoms of data subjects
• Measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure protection of personal data and to demonstrate compliance

Six recurring failures we audit out of SME DPIA files every quarter:

• Doing the DPIA after the system goes live (it must be before processing begins)
• No DPO sign-off (mandatory if you have a DPO)
• No data-subject consultation step documented (Art. 35(9))
• Treating the DPIA as a one-off — it must be reviewed when the processing changes materially
• No prior-consultation submission to the supervisory authority despite high residual risk (Art. 36)
• Generic risk descriptions copy-pasted from a template without context

Run this on a single internal afternoon for most SME use-cases.

• 1. Threshold check: run the Art. 35(3) and 9-criteria tests. Document the answer either way — even a "no DPIA needed" decision should be recorded.
• 2. Process mapping: data inventory, lawful basis, retention period, data flows including international transfers (TIA may also be needed)
• 3. Risk assessment: rate likelihood and severity for each identified risk to data subjects
• 4. Mitigations and residual risk: list controls (encryption, pseudonymisation, access control, DPA with processors)
• 5. Sign-off and review cycle: DPO + Controller sign; calendar review at least annually or on material change

We publish an editable DPIA template aligned with EDPB WP248, AEPD guidance and CNIL methodology in our Resource Library. If you want a senior privacy review, we offer a fixed-price 2-hour DPIA review service — your draft, our annotations, ready for DPO sign-off. Book a discovery call and we will quote within one business day.