EU GDPR DPIA and risk management

Start with the planned processing, not with a template. Article 35 applies before processing where a type of processing, especially one using new technologies, is likely to result in a high risk to natural persons after considering the nature, scope, context, and purposes of the processing.

The GDPR lists three cases where a DPIA is particularly required: systematic and extensive automated evaluation or profiling with legal or similarly significant effects, large-scale processing of special category data or criminal-offence data, and large-scale systematic monitoring of a publicly accessible area. A single DPIA may cover similar processing operations that present similar high risks.

Article 35(7) gives the minimum contents: a systematic description of the envisaged processing and purposes, an assessment of necessity and proportionality, an assessment of risks to individuals' rights and freedoms, and measures envisaged to address those risks and demonstrate GDPR compliance.

Treat the DPIA as an evidence package. The DPC sample structure and CNIL templates both point toward a processing overview, data and recipient map, consultation record, necessity and proportionality analysis, risk table, mitigation plan, residual-risk approval, DPO advice where applicable, and review owner.

CNIL frames a PIA around four linked steps: context, fundamental principles, risks, and validation. It separates non-negotiable legal principles from risk treatment, so a team cannot accept a high business benefit as a substitute for lawful purpose, minimisation, transparency, rights handling, processor control, or transfer compliance.

For risk analysis, CNIL asks teams to identify feared events, impacts, threats, risk sources, vulnerabilities, severity, and likelihood. The DPC guidance similarly expects a methodological risk record and allows use of the organisation's existing risk tools if they capture data-protection risks and the measures selected to reduce them.

Record what changed because of the DPIA. For every material risk, identify the measure selected, the expected risk reduction, the owner, implementation timing, and the remaining risk after the measure. CNIL calls those remaining risks residual risks, and its method requires the controller to decide whether selected controls, residual risks, and the action plan are acceptable.

The DPC guidance is explicit that not all risks can be eliminated. Teams can proceed without prior consultation when risks have been identified and mitigated so that no residual high risk remains, but accepted residual high risks require escalation before the project moves forward.

Prior consultation is not a general authority pre-clearance step for every DPIA. Article 36 requires the controller to consult the supervisory authority before processing where the Article 35 DPIA indicates that the processing would result in high risk in the absence of measures taken by the controller to mitigate that risk.

The DPC guidance states the operational boundary in practical terms: if identified risks have been mitigated, consultation is not necessary before proceeding; if residual risk remains high, the controller must consult before moving forward. Even where consultation is not required, the DPIA record should be retained, updated, and available for later audit or investigation.

If the supervisory authority considers the intended processing would infringe the GDPR, Article 36 gives it up to eight weeks after receiving the consultation request to provide written advice and permits a six-week extension for complexity. It must tell the controller and, where applicable, the processor about the extension and reasons within one month of receipt. These periods may be suspended while the authority waits for requested information, so the controller should not treat the nominal clock as permission to start processing.