DPIA: carrying out a data protection impact assessment

A DPIA (data protection impact assessment) is an assessment that the controller must carry out before launching personal data processing that is likely to result in a high risk to people's rights and freedoms. Required by Article 35 of the GDPR, it describes the processing, checks that it is necessary and proportionate, assesses its risks and sets out the measures to reduce them. It is mandatory as soon as the processing appears on the supervisory authority's list or meets at least two of the nine EDPB criteria.

Article 35 of the GDPR requires the controller, before processing begins, to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data where the processing is "likely to result in a high risk to the rights and freedoms of natural persons". It is one of the most concrete tools of the accountability principle: rather than registering its files with the authority as before 2018, the organisation demonstrates for itself that it has weighed the risks and made the right decisions.

The French authority, the CNIL, describes the DPIA as a tool for building processing that is compliant and respects privacy. Several names refer to the same exercise: DPIA in the GDPR, AIPD in French, and PIA (Privacy Impact Assessment), the older name the CNIL kept for its method and software.

A key point that is often misunderstood: the DPIA looks at risks to the people whose data is processed (employees, patients, customers, service users), not risks to the organisation. A health data leak is measured here by its consequences for patients (discrimination, reputational harm, distress), not by the cost of remediation. A single DPIA can cover a set of similar processing operations that present similar risks, so there is no need to start again for each site or subsidiary.

The GDPR does not require a DPIA for every processing operation: most only need an entry in the record of processing activities. The obligation is triggered through four successive gateways.

The three cases listed in Article 35(3) GDPR

The text first expressly covers:

• a systematic and extensive evaluation of personal aspects based on automated processing (including profiling), on which decisions producing legal effects are based;
• large-scale processing of special categories of data (health, biometrics, opinions…) or of data relating to criminal convictions and offences;
• systematic monitoring of a publicly accessible area on a large scale.

The 9 EDPB criteria and the two-criteria rule

To go beyond these three cases, the Article 29 Working Party, now the European Data Protection Board (EDPB), published guidelines (WP248) listing nine high-risk criteria. The CNIL draws a simple rule from them: processing that meets at least two criteria must undergo a DPIA. The nine criteria are evaluation or scoring, automated decisions with legal effect, systematic monitoring, sensitive or highly personal data, large scale, matching datasets, vulnerable data subjects, innovative use, and preventing people from exercising a right or using a contract. Test your processing below.

The CNIL list of processing requiring a DPIA

Each supervisory authority publishes its own list. The CNIL adopted a list of fourteen types of processing for which a DPIA is always required (decision no. 2018-327). It includes:

• health data processing by healthcare or social-care institutions, and health data warehouses;
• profiling of employees for HR purposes, such as algorithmic screening of applications, and constant monitoring of their activity;
• whistleblowing schemes and social or health-related reporting systems;
• profiling that may lead to exclusion from a contract (credit scoring) or that uses external data (data brokers);
• biometrics applied to vulnerable people, and large-scale location data.

The list is not exhaustive: processing that is not on it may still require a DPIA if it meets two criteria.

When a DPIA is not required

Conversely, a second list of twelve types of processing (decision no. 2019-118) provides exemptions, such as HR management in an organisation with fewer than 250 staff and no profiling, supplier management, badge access control without biometrics, or patient management by a healthcare professional working alone. A DPIA is also unnecessary if the processing clearly presents no high risk, if it is very similar to processing that has already been assessed, or if it relies on a legal basis whose adoption already involved an impact assessment. In every case, document your reasoning: that is what an inspector will ask for.

Article 35(7) of the GDPR sets a minimum content in four parts:

• a systematic description of the envisaged processing operations and their purposes, including, where applicable, the legitimate interest pursued;
• an assessment of the necessity and proportionality of the operations in relation to the purposes;
• an assessment of the risks to the rights and freedoms of data subjects;
• the measures envisaged to address those risks: safeguards, security measures and mechanisms to protect the data and demonstrate compliance.

In practice, a good DPIA report can be read by management in a few pages: a map of the processing, an analysis of the principles (legal basis, data minimisation, retention periods, information and rights of data subjects, oversight of processors and transfers), a risk assessment showing risk levels before and after measures, and the signed final decision.

The GDPR does not impose a method. In France, the reference is the CNIL PIA method, published in three guides (the method, the templates, the knowledge bases) plus a case study. It has four steps, carried out iteratively.

Step 1: study the context

Describe the processing, its purposes, its stakes and its controller, then the data processed, its life cycle (collection, storage, use, deletion) and the assets that support it: applications, servers, service providers, paper. This description underpins everything else: a DPIA that skimps on it produces a risk analysis detached from reality.

Step 2: check the fundamental principles

First check that the processing is necessary and proportionate: a specified purpose, a legal basis, adequate and limited data, justified retention periods. Then review the measures that protect people's rights: information, consent where applicable, rights of access, rectification, erasure and objection, contracts with processors, transfers outside the EU.

Step 3: assess the risks to data security

The CNIL reasons in terms of three feared events: illegitimate access to data, unwanted modification and disappearance. They map to confidentiality, integrity and availability, the criteria found in the DICP classification. For each one, identify the impacts on people, the threats and their sources, then estimate severity and likelihood. Plotting these risks on a risk matrix helps decide where to focus effort.

Step 4: validate the DPIA

Build the action plan, obtain the DPO's opinion and, where possible, that of data subjects or their representatives, then the controller decides: DPIA validated, to be improved, or rejected. If risks remain too high, go back to the previous steps to strengthen the measures.

The tools: the CNIL PIA software and the European template

The CNIL distributes free, open-source PIA software for Windows, macOS and Linux, or for deployment on a server, which guides users step by step through its method and includes a legal and technical knowledge base. At European level, the EDPB adopted a harmonised DPIA template in April 2026, with an explanatory note, and put it out to public consultation until 9 June. The template mainly aims to make DPIAs comparable across countries; the EDPB states that it is not mandatory and that organisations remain free to choose their method. Whatever the format, running your DPIAs in GDPR compliance software linked to the record of processing avoids versions scattered across spreadsheets.

Responsibility for the DPIA lies with the controller, which in practice means the business unit that owns the project. It cannot be handed over entirely to the DPO, who should not be both judge and party.

• The data protection officer (DPO) advises on how the DPIA is conducted and monitors its performance; their opinion is recorded in the file.
• The CISO assesses existing or planned security measures and supports the risk assessment. On this role, read our article on the CISO.
• Business and delivery teams describe the processing and implement the measures.
• The processor (software vendor, hosting provider) provides the necessary information, as required by Article 28 of the GDPR. Assessing it is part of your third-party risk management.
• Data subjects or their representatives are consulted where appropriate, for example staff representatives for an HR tool.

The right time to start the DPIA is the design phase, in line with data protection by design (Privacy by Design): it is much cheaper to drop an unnecessary data field on a mock-up than in software already in production. The DPIA is then reviewed whenever the processing changes: a new purpose, a new category of data, a new processor.

A DPIA is not normally sent to the authority: it is kept on file and produced in the event of an inspection. However, if it shows that the processing would result in a high residual risk despite the planned measures, Article 36 of the GDPR requires the controller to consult the supervisory authority before processing begins. In France, this is done through the CNIL's online service.

The authority then has eight weeks, which may be extended by six weeks depending on the complexity of the processing, to provide written advice. It may also use its corrective powers. Failing to carry out a mandatory DPIA, or failing to consult the authority when required, can lead to a fine of up to €10 million or 2% of total worldwide annual turnover (Article 83(4) GDPR).

Both approaches share a vocabulary (threats, severity, likelihood, measures) and feed into each other, but they do not answer the same question. A cyber risk analysis, carried out for example with EBIOS Risk Manager or following ISO 27005, protects the organisation's missions and assets.

Security measures chosen in one often serve the other: encrypting a database protects both the patients and the hospital. Running both exercises in the same tool avoids describing the same assets and measures twice.

Take a company with 1,200 employees that deploys online software to pre-screen job applications. The tool scores each CV and ranks the candidates; the vendor hosts the data. This simplified, fictitious example follows the four steps.

Is the DPIA mandatory?

Yes, on two counts. The processing is on the CNIL list (profiling for recruitment) and it meets several criteria: scoring candidates, innovative use (a selection algorithm), and the risk of excluding people from a contract, in this case employment.

Context and principles

The data processed covers identity, career history, skills and the score. Under data minimisation, the team removes the photo and date of birth from the form, as they serve no purpose for screening. Because Article 22 of the GDPR restricts fully automated decisions, every rejection is reviewed by a recruiter. Candidates are told an algorithm is used, and the contract with the vendor includes the Article 28 clauses.

Risks and measures

After the measures, the residual risks are deemed acceptable: the DPO gives a favourable opinion, HR management validates the DPIA, and prior consultation of the authority is not needed. The DPIA will be reviewed if the vendor changes its scoring model.