When does the EU GDPR require a DPIA?

A DPIA is mandatory when the planned processing is likely to result in a high risk to individuals. Article 35 says the controller must assess the impact before the processing starts, especially where new technologies are used and the nature, scope, context, and purposes of the operation make the risk high.

Article 35(3) gives three cases where a DPIA is required in particular: systematic and extensive automated evaluation, including profiling, that produces legal or similarly significant effects; large-scale processing of special-category data or criminal-offence data; and large-scale systematic monitoring of a publicly accessible area.

Start with the three Article 35(3) cases, then test the broader WP29 high-risk criteria: evaluation or scoring, automated decisions with legal or similarly significant effects, systematic monitoring, sensitive or highly personal data, large scale, matched or combined datasets, vulnerable people, innovative technology or organisational solutions, and processing that prevents people from exercising a right or using a service or contract.

The criteria screen for Article 35's likely-high-risk test. WP29 says meeting two criteria will usually indicate that a DPIA is required, while some processing may require one after meeting only one criterion. A controller that concludes two or more criteria do not create likely high risk should document its reasons and include the DPO's views where a DPO is designated.

Article 35(4) requires each supervisory authority to establish and publish a list of processing operations that are subject to the DPIA requirement, and Article 35(5) allows a supervisory authority to publish a list of operations for which no DPIA is required. Use those lists as a jurisdiction-specific check only where the relevant list is actually available and applicable to the processing operation.

Do not treat a general guidance page, sector label, vendor statement, or non-applicable national list as an exemption. If a no-DPIA list is used, the decision should explain why the processing falls strictly within the listed procedure and continues to meet the relevant requirements.

If the threshold is met, Article 35(7) requires the DPIA to contain at least four elements: a systematic description of the envisaged processing and purposes, an assessment of necessity and proportionality, an assessment of risks to data subjects' rights and freedoms, and the measures envisaged to address those risks and demonstrate GDPR compliance.

CNIL's PIA methodology maps those elements into practical records: context and processing description; fundamental-principles analysis covering purpose, lawfulness, minimization, storage, information, rights, processors, and transfers; privacy-risk analysis; and formal validation involving DPO advice and, where appropriate, views of data subjects or their representatives.