What Is a Data Protection Impact Assessment?
A Data Protection Impact Assessment (DPIA) is a process designed to help you systematically analyze, identify, and minimize the data protection risks of a project or processing activity. It is required under GDPR Article 35 when processing is likely to result in a high risk to the rights and freedoms of natural persons.
A DPIA is not just a compliance checkbox — it is a practical tool that helps you design better, more privacy-respecting systems. By identifying risks early, you can build in protections from the start (privacy by design) rather than retrofitting them after problems emerge.
The DPIA must be carried out before the processing begins. It should be reviewed and updated as the processing evolves, especially when there are changes that affect the risk level.
When Is a DPIA Mandatory?
GDPR Article 35(3) lists three specific cases where a DPIA is always required:
Systematic and extensive profiling with significant effects — automated evaluation of personal aspects used to make decisions that produce legal effects or similarly significant effects on individuals. This includes credit scoring, insurance pricing based on behavior, and automated hiring decisions.
Large-scale processing of special category data — health records, biometric data, genetic data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, or criminal offence data processed at scale.
Systematic monitoring of publicly accessible areas — CCTV surveillance, Wi-Fi tracking, or other systematic observation of public spaces on a large scale.
Beyond these mandatory cases, the European Data Protection Board (EDPB) guidelines suggest that a DPIA should be conducted when processing meets two or more of these criteria: evaluation/scoring, automated decision-making with legal effects, systematic monitoring, sensitive data, large scale, matching/combining datasets, vulnerable data subjects, innovative technology, or processing that prevents exercise of rights.
What Must a DPIA Contain?
GDPR Article 35(7) specifies the minimum content of a DPIA:
Description of the processing — a systematic description of the envisaged processing operations and their purposes, including the legitimate interest pursued where applicable.
Necessity and proportionality assessment — an assessment of whether the processing is necessary and proportionate in relation to the purposes.
Risk assessment — an assessment of the risks to the rights and freedoms of data subjects.
Measures to address risks — the measures envisaged to address the risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data.
Our tool walks you through each of these elements systematically, helping you document a DPIA that meets these requirements.
Frequently Asked Questions
Who is responsible for conducting a DPIA?
The data controller is responsible for conducting the DPIA. In practice, it is typically carried out by the project team with input from the Data Protection Officer (DPO). Article 35(2) requires the controller to seek the advice of the DPO where one is designated. The DPO should review the DPIA but does not have to conduct it personally.
What happens if risks cannot be mitigated?
If the DPIA indicates that the processing would result in a high risk that cannot be sufficiently mitigated, Article 36 requires the controller to consult the supervisory authority (prior consultation) before proceeding. The authority has up to 8 weeks to provide written advice, which may include instructions to modify or prohibit the processing.
Do I need to publish my DPIA?
GDPR does not require you to publish your DPIA. However, you must be able to demonstrate it to the supervisory authority upon request. Some organizations choose to publish a summary as a transparency measure. The DPIA should be kept as an internal record and updated as processing changes.
Is my DPIA data stored anywhere?
No. Everything happens in your browser. No data is sent to any server. Use the Copy Summary button on the results page to save your DPIA before leaving — once you close or refresh, all data is gone.
Related Tools
Data Flow Mapping Tool
Map your data flows before conducting a DPIA.
GDPR Breach Cost Calculator
Estimate the financial impact if identified risks materialize.
Related Articles
DPIA Step-by-Step Guide
Comprehensive guide to GDPR Article 35.
Top GDPR Fines 2025-2026
Missing DPIAs are themselves fineable.
Disclaimer: This tool assists with DPIA documentation but does not constitute legal advice. A DPIA should involve your DPO and may require input from qualified data protection professionals. Created by ClevSec.
Last updated: March 2026