Data protection impact assessment (DPIA): when it is required and how to do it

When is a DPIA required?

Art. 35(1) GDPR requires a DPIA where a processing is likely to result in a high risk to the rights and freedoms of natural persons, in particular when using new technologies. You carry it out beforehand, before the processing starts. Several similar operations with similarly high risks may be assessed together.

Paragraph 3 names three cases where it is required in any event: a systematic and extensive automated evaluation of people on which decisions with legal or similarly significant effects are based; large-scale processing of special categories of data or of data on criminal offences; and systematic large-scale monitoring of a publicly accessible area.

Whether a processing falls under this, your company checks itself. Germany's Data Protection Conference calls this first step a threshold analysis. In its view you record the decision for or against a DPIA, with reasons, in writing.

Art. 35(1) and (3) GDPR

When does the DSK list apply, and what is on it?

Each supervisory authority publishes a list of the kinds of processing that require a DPIA (Art. 35(4)). For companies in Germany that is the list of the Data Protection Conference (DSK) for the non-public sector, version 1.1 of 17.10.2018. If your processing is on it, the DPIA is mandatory.

In our assessment, three of the 17 entries are the closest to a business with 50 to 250 staff. No. 8: large-scale data on employees' behaviour that can be used to assess their work with legal consequences, such as locating them in the field. No. 11: AI that processes personal data to interact with people or to evaluate them. No. 1: biometric identification, for example by fingerprint for access control, where one more criterion applies.

The list is not exhaustive, as the DSK itself says. If a processing is not on it, you check Art. 35(1) with the nine criteria of the European guidelines WP 248 that the list follows: sensitive or highly personal data, vulnerable data subjects such as employees, large-scale processing, systematic monitoring, new technology, evaluation or scoring, matching or combining datasets, automated decisions with legal effect, and preventing people from exercising a right or using a contract. If a processing meets two of them, the guidelines say a DPIA is required in most cases.

If any of your processing is subject to a DPIA, in Germany you also need a data protection officer, regardless of the number of persons employed in processing (§ 38(1), second sentence, BDSG).

Art. 35(4) GDPR · § 38(1) BDSG

What goes into a DPIA

Art. 35(7) sets the minimum content: a systematic description of the envisaged operations and their purposes, an assessment of whether they are necessary and proportionate for the purpose, an assessment of the risks to the data subjects, and the measures envisaged to address them.

If a data protection officer is designated, you seek their advice (paragraph 2). Where appropriate you seek the views of the data subjects or their representatives (paragraph 9); the DSK gives the works council as an example.

If a high risk remains that you cannot mitigate with appropriate measures, you consult the supervisory authority before you start (Art. 36(1), recital 84). For companies in Germany that is the authority of their federal state (§ 40 BDSG). If the risk changes later, you review the DPIA (Art. 35(11)).

Art. 35(2), (7), (9) and (11) · Art. 36(1) GDPR

An example: tracking the service vans

Keller Haustechnik GmbH (made up, 90 staff) wants to track its service vans by GPS so that dispatch can plan jobs better. The DSK list names locating employees to coordinate field work under no. 8. So the DPIA is due before installation.

The description records which data arise (location, time, vehicle, who is driving), who sees them and how long they are kept. On necessity Keller asks: does dispatch need the location all the time or only during a job, and what happens after hours?

The risk for the technicians is a complete movement profile that could be used to monitor performance. Keller decides on tracking only during working hours, a button for private trips, access for dispatch only and deletion after a fixed period; the works council and the data protection officer are heard. If no high risk remains after that, tracking starts and the DPIA goes into the records.

Common DPIA mistakes

Writing the DPIA once the system is already running. Art. 35(1) requires it beforehand, and according to the DSK existing processing can also fall under the duty.

Taking the IT security risk analysis for a DPIA. One asks what an outage or attack costs your business. The DPIA asks what a processing means for the people whose data it uses.

With an AI assistant

An AI assistant such as Claude, ChatGPT or Copilot can draft the systematic description under Art. 35(7) from your process description and the vendor's offer. It can check the processing against the DSK list and WP 248 and prepare questions for your data protection officer.

Whether there is a high risk, which measures you take and whether you consult the authority is your company's decision. Give the assistant descriptions instead of real staff data, because whatever you show it, its vendor processes too.

In our reading, having an assistant draft a DPIA from your own records does not fall under no. 11 of the list, as long as nobody is evaluated in the process. A GDPR walkthrough on nisd2.eu is in the works, with the same MCP server as the NIS 2 walkthrough.