When is a data protection impact assessment mandatory?

When processing, in particular using new technologies, is likely to result in a high risk to people's rights and freedoms. The regulation names three cases where an assessment is required in particular: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, that leads to significant decisions; large-scale processing of special categories of data or criminal data; and systematic large-scale monitoring of a publicly accessible area. In addition, the supervisory authority publishes a list of processing operations that require an assessment.

Must the assessment be sent to the Data Protection Ombudsman?

Not as a rule. The assessment is carried out and documented within the organisation. The supervisory authority must be consulted beforehand only if the assessment shows that the processing would result in a high risk that the controller cannot sufficiently reduce by its own measures. The assessment must be reviewed at least when the risk of the processing changes.

Data protection impact assessment: when a DPIA is mandatory and what goes into it

Q: What must the impact assessment contain?

At least a systematic description of the processing operations and their purposes, an assessment of the necessity and proportionality of the processing in relation to the purposes, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address the risks, including safeguards and security measures. The data protection officer's advice must be sought, and where appropriate the views of data subjects or their representatives.

Q: Does the AI Act's fundamental rights impact assessment replace the DPIA?

No, but they complement each other. Under Article 27 of the AI Act the fundamental rights impact assessment complements an existing data protection impact assessment, and Article 26(9) obliges the deployer of a high-risk system to use the information received from the provider in its impact assessment. In practice an AI procurement goes through one assessment process in which both parts are done.

Article 35 of the GDPR requires an impact assessment when processing is likely to result in a high risk. When it must be done, what it must contain and what AI changes.

In brief

A data protection impact assessment, DPIA for short, is the assessment under Article 35 of the GDPR that a controller must carry out before processing when the processing is likely to result in a high risk to people's rights and freedoms. It is not a form but a chain of reasoning: what is done, why it is necessary, what can go wrong and what is done about it. The assessment is required in particular for significant decisions based on profiling, large-scale processing of sensitive data and systematic monitoring of public spaces. The arrival of AI in workplaces has made it mandatory more often than many notice.

When an assessment is required

Article 35(1) sets the general rule: where a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. The nature, scope, context and purposes of the processing decide. A single assessment may address a set of similar processing operations that present similar high risks.

Paragraph 3 names three situations in which an assessment is required in particular.

Situation	What it means at work
A systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based	Scoring job applications, risk-classifying customers, prioritising benefit cases by algorithm
Large-scale processing of special categories of data or of data on criminal convictions and offences	Patient and client data in health and social care, occupational health data on all staff, criminal record extracts
Systematic monitoring of a publicly accessible area on a large scale	Camera surveillance of a street, a shopping centre or a station, especially with analytics

Paragraph 4 additionally obliges the supervisory authority to draw up and publish a list of the kinds of processing operations that require an assessment. In Finland the Data Protection Ombudsman's list is where you check whether your own processing falls within the required kinds; under paragraph 5 the authority may also publish a list of processing operations for which no assessment is required.

What the assessment must contain

Paragraph 7 lists the minimum content. The assessment contains a systematic description of the envisaged processing operations and the purposes of the processing, including where applicable the controller's legitimate interests; an assessment of the necessity and proportionality of the processing in relation to the purposes; an assessment of the risks to the rights and freedoms of data subjects; and the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance.

The four items come in that order for a reason. If the description is vague, necessity cannot be assessed. If necessity has not been assessed, the risk is calculated for processing that perhaps need not happen at all. The most common weakness in assessments is the second item: the question "could the same be achieved with less" is not asked, because the procurement has already been decided.

Paragraph 2 requires seeking the advice of the data protection officer where one has been designated, and paragraph 9 requires seeking, where appropriate, the views of data subjects or their representatives. At a workplace the latter often means staff representatives, and it connects to the cooperation procedure described in A supervisor's data protection duty.

What happens after the assessment

The assessment is not sent anywhere. It is documented, and it is part of the evidence by which the controller demonstrates compliance with the regulation. Article 36 brings one exception: where the assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate it, the supervisory authority must be consulted before processing begins. This is rare, and it is meant to be: an assessment normally leads to measures that bring the risk down to an acceptable level.

Paragraph 11 requires reviewing the assessment where necessary, and at least when there is a change in the risk represented by the processing operations. A new feature in the system, a new data source or a new purpose are all changes that reopen the assessment. A one-off document at procurement time therefore does not satisfy the article if the system keeps evolving.

What AI changes

AI can touch all three situations in paragraph 3. A language model that screens applications and influences the selection is an evaluation of personal aspects based on automated processing. Speech recognition in customer service processes voice, which can reveal a person's state of health, and on a large scale it falls under point (b). Analytics on camera surveillance turns large-scale surveillance into systematic monitoring. Where one of the situations in paragraph 3 is met, the assessment is mandatory as such, without a separate conclusion on how high the risk is. The mere use of new technology is not such a situation: in paragraph 1 it is a reason to assess the risk, not a reason to presume it high. The first step of an AI procurement is therefore a short screening, a recorded decision on whether the processing falls within the paragraph 3 situations or the supervisory authority's list, or is otherwise high-risk, and the full impact assessment is done when any of these holds.

The AI Act ties its own obligations to this. Article 26(9) obliges the deployer of a high-risk system to use the information the provider supplies under Article 13 to fulfil its obligation to carry out a data protection impact assessment, and Article 27(4) says the fundamental rights impact assessment complements an existing data protection impact assessment. In the public sector the two assessments are therefore done in one process in which the data protection officer and the AI officer each do their part. The AI Act side is covered in High-risk AI.

What the assessment is not

It is not a permit. A well-made assessment does not make unlawful processing lawful; it reveals when the legal basis is missing or necessity is not met, and then the right outcome is not to proceed. Nor is it a security audit, although security measures are part of it: the risk is assessed from the person's point of view, not the organisation's. And it is not a document the data protection officer writes alone. The controller is responsible for the assessment, the data protection officer advises, and whoever knows the processing writes the description.

Our skills catalogue treats risk-based data protection and impact assessment as a level 4 skill of the data protection officer, and it is one of the six skills the Data Protection Officer Competence learning path verifies. The data protection officer's role as a whole is described in When must a data protection officer be appointed and what must they know?. When something goes wrong despite the assessment, the next step is in Personal data breach.