When does the EU GDPR require a DPIA?

A DPIA is mandatory when the planned processing is likely to result in a high risk to individuals. Article 35 says the controller must assess the impact before the processing starts, especially where new technologies are used and the nature, scope, context, and purposes of the operation make the risk high.

Article 35(3) gives three cases where a DPIA is required in particular: systematic and extensive automated evaluation, including profiling, that produces legal or similarly significant effects; large-scale processing of special-category data or criminal-offence data; and large-scale systematic monitoring of a publicly accessible area.

Start with the three Article 35(3) cases, then test the broader high-risk criteria described in DPIA guidance: evaluation or scoring, automated decisions with legal or similar significant effects, systematic monitoring, sensitive or criminal-offence data, large scale, matched or combined datasets, vulnerable people, innovative technology, cross-border transfers outside the EU, and processing that prevents people from exercising a right or using a service or contract.

The DPC guidance reports the WP29 rule of thumb: the more criteria a processing operation meets, the more likely it is to require a DPIA; operations meeting at least two criteria will require a DPIA, and a controller that decides otherwise should thoroughly document why the processing is not likely to be high risk.

Article 35(4) requires each supervisory authority to establish and publish a list of processing operations that are subject to the DPIA requirement, and Article 35(5) allows a supervisory authority to publish a list of operations for which no DPIA is required. Use those lists as a jurisdiction-specific check only where the relevant list is actually available and applicable to the processing operation.

Do not treat a general guidance page, sector label, vendor statement, or non-applicable national list as an exemption. If a no-DPIA list is used, the decision should explain why the processing falls strictly within the listed procedure and continues to meet the relevant requirements.

If the threshold is met, Article 35(7) requires the DPIA to contain at least four elements: a systematic description of the envisaged processing and purposes, an assessment of necessity and proportionality, an assessment of risks to data subjects' rights and freedoms, and the measures envisaged to address those risks and demonstrate GDPR compliance.

CNIL's PIA methodology maps those elements into practical records: context and processing description; fundamental-principles analysis covering purpose, lawfulness, minimization, storage, information, rights, processors, and transfers; privacy-risk analysis; and formal validation involving DPO advice and, where appropriate, views of data subjects or their representatives.