GDPR Article 35(1) mandates a DPIA whenever processing is "likely to result in a high risk to the rights and freedoms of natural persons". The EDPB (WP248 rev.01) publishes nine criteria — meeting two or more triggers a DPIA obligation.
A DPIA accepted by AEPD/CNIL/AP must contain four mandatory sections per Article 35(7). Skipping any section invalidates the assessment.
Article 36 obliges prior consultation when the DPIA shows the processing would result in a high residual risk in the absence of measures taken to mitigate it. Spanish AEPD guidance is strict here — they expect a formal submission with the full DPIA, the controller’s view of risk, the DPO advice, and a mitigation plan.
In our 2025 audit cycle 73% of SME DPIAs we reviewed had at least one of these defects. Each is independently sanctionable.
Our editable DOCX template includes the four sections, a likelihood × severity matrix aligned with ENISA methodology, a record-of-processing mapping, and an EDPB-aligned risk register. We have used it on 80+ SME DPIAs across Spain, France and Netherlands without authority pushback.
Contact us for personalized support with this issue.