DPIA in practice – how to do an impact assessment that holds up

A data protection impact assessment – DPIA, short for Data Protection Impact Assessment – is the analysis that must be carried out before starting processing that is likely to result in a high risk to the rights and freedoms of data subjects. The basis is Article 35 of the GDPR, and the purpose is practical: to identify the risks in time and decide what you will do about them.

What a DPIA is – and what it is not

A DPIA is an assessment, not a description. That sounds obvious, but it is where most fall down: the document becomes a tidy account of a system, without anyone ever answering the question of what can go wrong and what has been done to prevent it.

The starting point is always the individual. What does it mean for them if the data ends up in the wrong place, if a decision turns out wrong, if someone unauthorised gains access or if they no longer have control over their data? That is the question the assessment must answer – the technology is only the means.

Nor is a DPIA a one-off project. It describes processing at a point in time and must be kept alive for as long as the processing continues.

When a DPIA is required

Under Article 35, an assessment is required when a type of processing is likely to result in a high risk to the rights and freedoms of natural persons. The article singles out three situations in particular:

• systematic and extensive evaluation of personal aspects, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the person,
• processing of sensitive data on a large scale, for example health data or data relating to criminal offences,
• systematic monitoring of a publicly accessible area on a large scale.

The supervisory authorities draw up lists of which processing operations require a DPIA. In Sweden, IMY, the Swedish Authority for Privacy Protection, publishes such a list, and it is a reasonable starting point when you are unsure. If you are still unsure, carry out a preliminary assessment and document your reasoning, even if you conclude that a full DPIA is not needed. A documented assessment is always better than a silent guess.

A new DPIA is not needed if an equivalent assessment already exists for similar processing – but only provided it still describes how you actually process the data today. The risk changes when you switch supplier, add a purpose, connect a new data source or move the data to another country. When that happens, the assessment must be reviewed.

What the assessment must contain

Article 35(7) lists four parts. They sound heavier than they are, and they fit together: the description is the foundation, necessity and proportionality test whether the processing may go ahead as intended, the risk assessment says what is at stake and the measures respond to it.

Note the word planned. The measures must be decided and feasible to implement, not wishful thinking in a closing bullet point.

How to do it in practice

A DPIA becomes manageable if you work through it in order and write as you go. Seven steps are usually enough:

1. Define the scope of the processing. Decide what is included: a system, a process or an entire service. A clear scope makes the rest manageable – and makes it possible to see when something changes.
2. Map data flows and suppliers. What data is collected, where does it come from, where is it stored, who sees it, where is it sent and how long is it kept? Include processors, sub-processors and any transfers to third countries.
3. Assess necessity and proportionality. Test each piece of data against the purpose: is it needed, and is there a less intrusive way to achieve the same result? This is usually where the simplest and cheapest improvements are found.
4. Assess the risks. Start from the data subject, not from the system. What can go wrong, how likely is it and how serious would it be? Think both about what can happen – breaches, misuse, unauthorised access, wrong decisions – and about how the individual is affected.
5. Decide measures and owners. Every risk needs a response: a technical measure, a routine, a contractual clause or a conscious decision to accept the risk. Put names and dates on them.
6. Document your position. What are you deciding, who made the decision and which risks remain? Where applicable, the advice of the data protection officer must be sought, and this must be clear from the documentation. Where appropriate, you can also seek the views of data subjects or their representatives.
7. Plan for review. Set a date and a trigger. New purposes, new suppliers, new technology, an incident or changed rules mean the assessment must be revisited.

DPIA, records and supplier assessment – three different things

These three are mixed up surprisingly often, and as a result one of them is left undone.

The record of processing activities (Article 30) is your register of all the processing you carry out. It must exist at all times and be kept up to date, and it describes what you do. A DPIA is an in-depth assessment of a single processing operation that is likely to result in a high risk, and it is done before the processing starts. The supplier assessment is about the counterparty: how the processor handles the data, where it is processed, which sub-processors are used and what guarantees you have. It is important input to a DPIA, but never replaces it.

A practical consequence: a DPIA may show that you need to change supplier, negotiate terms or move a processing operation. That is why it must come before the procurement, not after.

The five mistakes we see most often

• The DPIA is done after the system is built. By then the cheap solutions are gone, and the assessment becomes an after-the-fact description instead of a basis for decisions.
• An old DPIA is copied wholesale. The wording may well be right, but it describes a different processing operation, different suppliers and different risks.
• The technology is described, but not the risk to individuals. The reader learns how the system works – but not what it means for a human being.
• The measures have no owner and no date. Without a name and a deadline the list is a wish list, and nothing happens.
• Nobody follows up. The assessment stays as a document in a folder while the business changes.

Get started in the right order

Start by listing the processing you carry out and marking the operations that are likely to result in a high risk. That is often enough to see where you need a DPIA first. If you have AI systems that make or support decisions about people, they are almost always worth a closer look, both under the GDPR and under the EU AI Act.

We help you carry out the assessment in practice: scoping the processing, going through data flows and contracts, setting measures with owners and dates, and documenting in a way that holds up if IMY or a customer asks questions. Read more about GDPR and data protection and AI and the AI Act, or see how we approach privacy in our own deliveries. More guides are available under Insights.