Data Protection Impact Assessment (DPIA): when is it mandatory and how does a DPO support it
·
Updated on ·
By 
Bertrand Bucelle · 7 min read
In brief
- The data protection impact assessment (DPIA, or AIPD in French) is mandatory for processing operations likely to result in a high risk to the rights and freedoms of individuals (Article 35 of the GDPR): large-scale sensitive data, systematic monitoring, profiling. The DPO advises on its necessity and supports its implementation.
What is a DPIA?
A DPIA is a study that assesses the risks a processing operation poses to the rights and freedoms of individuals, and the measures to reduce them. It is provided for in Article 35 of the GDPR and is mandatory when the processing is likely to result in a high risk.
When is it mandatory?
CNIL has published a list of processing operations for which a DPIA is required. These notably include: large-scale processing of sensitive data, large-scale systematic monitoring, profiling with legal effects, or data matching. In case of doubt, the DPO decides.
The stages of a DPIA
- Describe the processing and its context
- Assess necessity and proportionality
- Identify risks to data subjects
- Define measures to reduce these risks
- Document and have the analysis validated
The DPO's role
The DPO advises on the necessity of conducting a DPIA, supports its implementation and provides an opinion. If residual risks remain high despite the measures, CNIL must be consulted before implementing the processing. The DPO oversees this step.
DPIA and artificial intelligence
Processing operations incorporating AI, often innovative and large-scale, frequently require a DPIA. With the entry into application of the AI Act, these analyses are becoming a point of convergence between GDPR and AI regulation, which the DPO must know how to articulate.
Take action
Do your processing operations require a DPIA? Take stock with a Data Comply One expert.
Discover outsourced DPO →Test my compliance for free