The data protection impact assessment (DPIA) is the most frequently overlooked GDPR obligation - not because companies are rebelling, but because they do not know when it is required. And failing to carry out a DPIA where one was mandatory is a ground for a fine in its own right, regardless of whether anyone came to any harm.
- A DPIA has to be done before processing starts - done after go-live, it is an accident report, not an impact assessment.
- Failing to carry out a mandatory DPIA is a ground for a fine in its own right, regardless of whether any harm occurred.
- Rule of thumb: meeting two or more of the 9 WP29/EDPB criteria means a DPIA is mandatory by default.
- If your processing matches the UODO list issued under Article 35(4), the "high risk" debate is over - a DPIA is mandatory.
- Where the residual risk after mitigation is still high, you must consult the President of UODO before processing begins (Article 36); the authority generally has 8 weeks to respond.
What a DPIA is and why you do it
A DPIA (data protection impact assessment) is a structured analysis of planned processing of personal data - before you launch it. Legal basis: Article 35 GDPR. Purpose: to identify the risks to the rights and freedoms of data subjects and to plan measures that will reduce those risks.
The key word: before. A DPIA done after the system has gone live is an accident report, not an impact assessment. In practice, a well-run DPIA often improves the design itself - it forces questions about data minimisation, retention and access that nobody would otherwise ask.
When is a DPIA mandatory?
The general rule (Article 35(1))
A DPIA is required where a type of processing - in particular using new technologies - taking into account its nature, scope, context and purposes, is likely to result in a high risk to the rights and freedoms of natural persons.
Three cases named expressly (Article 35(3))
- A systematic and extensive evaluation of personal aspects based on automated processing (including profiling), on which decisions are based that produce legal effects concerning the person or similarly significantly affect them - e.g. credit scoring, automated pre-screening of job applicants.
- Large-scale processing of special categories of data (Article 9) or of data relating to criminal convictions (Article 10).
- Systematic monitoring of publicly accessible areas on a large scale - the classic example: an extensive CCTV system.
The 9 WP29/EDPB criteria
The Article 29 Working Party guidelines (WP248, endorsed by the European Data Protection Board, EDPB) set out nine criteria indicating high risk:
- evaluation or scoring (including profiling and predicting),
- automated decision-making with legal or similarly significant effect,
- systematic monitoring,
- sensitive data or data of a highly personal nature,
- processing on a large scale,
- matching or combining datasets,
- data concerning vulnerable data subjects (children, employees, patients),
- innovative use or application of new technological solutions (e.g. AI, biometrics, IoT),
- processing that prevents data subjects from exercising a right or using a service or a contract.
A practical rule of thumb: two or more criteria met = by default, you do a DPIA. With one criterion it is worth considering too - and if you decide a DPIA is not needed, document why. That document (the “threshold assessment”) can matter as much as the DPIA itself.
The UODO list
Pursuant to Article 35(4) GDPR, the President of UODO (the Polish data protection authority) has published a list of the kinds of processing operations that require a DPIA (a communication in Monitor Polski, the Polish official gazette). It includes, among others, profiling and evaluation of individuals (including scoring), systematic monitoring of employees, processing of biometric and genetic data, location tracking, children’s data and innovative technologies. If your operation matches an item on the list in the context described there, the “high risk” debate is over - a DPIA is mandatory. Always check the current version of the list on the UODO website.
How do you carry out a DPIA in 7 steps?
Article 35(7) sets out the minimum content of the assessment. In practice, this sequence works well:
- Describe the processing systematically. Purposes, categories of data and data subjects, data flows (from where, to where, via whom), recipients, retention periods, the systems and vendors used. A data flow diagram does more work here than ten pages of prose.
- Assess necessity and proportionality. Can the purpose be achieved with less data? Is the legal basis the right one? Is retention not set “just in case”? This is the moment when a DPIA genuinely improves the design.
- Seek the advice of your DPO - if you have designated one, advising on the DPIA is their statutory task (Article 39(1)(c)), and seeking their advice is your obligation (Article 35(2)). Where appropriate, also consider seeking the views of data subjects or their representatives (Article 35(9)) - e.g. consulting employees about monitoring.
- Identify the risks to data subjects. Note: this is about risk to people (discrimination, identity theft, financial loss, invasion of privacy, reputational damage), not the company’s business risk. This is the most common methodological mistake.
- Assess the risks. For each scenario: likelihood × severity of impact. The scale can be simple (low/medium/high) - what matters is that the ratings are consistent and justified, not mathematical sophistication.
- Plan mitigating measures. Pseudonymisation, encryption, access control, minimisation, shorter retention, transparent information, objection mechanisms, human oversight of automation. For each high risk: a measure + the residual risk once it is applied.
- Document, implement and come back to it. A DPIA is a living document - Article 35(11) requires a review when the risk changes. A new product feature, a new vendor, a new transfer country = an update of the assessment.
Prior consultation with UODO (Article 36)
If, after the planned measures have been applied, the residual risk is still high, you cannot simply start processing - you must consult the President of UODO before it begins. The authority generally has 8 weeks to provide its written advice (extendable by 6 weeks).
In practice, prior consultations are rare - and that is how it should be. If a DPIA concludes “high risk, nothing can be done”, it usually means the project needs redesigning, not the authority’s blessing. Consultation is a safety valve, not a route to legitimising risky ideas.
The most common mistakes
- A DPIA after go-live - assessing the impact of something that is already running does not serve its preventive function.
- Copy-paste from a template - a DPIA describing “the risk of unauthorised access” without reference to the specific system is worthless as evidence.
- Analysing the company’s risk instead of the risk to individuals - a UODO fine is not a risk you assess in a DPIA.
- No threshold assessment - a decision “we are not doing a DPIA” without a documented rationale looks like an omission during an inspection, not like a decision.
- A one-off exercise - systems change; a DPIA from three years ago describes a system that no longer exists.
This article is for information purposes only and does not constitute legal advice.