DPIA Guide: how to carry out a data protection impact assessment?

What is a DPIA?

The DPIA is a structured risk analysis process assessing the risks that a processing activity poses to the rights and freedoms of data subjects. It is provided for under Article 35 of GDPR and constitutes a cornerstone of the regulation's risk-based approach.

Its purpose is not merely to tick a box, but to help design processing that respects privacy: by identifying risks at an early stage, they can be mitigated through appropriate measures, or a disproportionate processing activity can be abandoned altogether.

It combines a legal dimension (necessity, proportionality, legal basis, rights) and a technical dimension (security, mitigation measures). This is why it is ideally conducted as a team effort, led by the DPO.

When is a DPIA mandatory?

A DPIA is required as soon as a processing operation is likely to result in a high risk. To help determine this, the CNIL provides lists and nine criteria; meeting at least two criteria is a strong indicator.

The nine criteria include in particular: evaluation/scoring, automated decision-making, systematic monitoring, sensitive data, large scale, data combination, vulnerable individuals, innovative use, and barrier to the exercise of a right.

What does a DPIA contain?

The GDPR sets a minimum content requirement. A complete DPIA consists of four structuring components.

• A systematic description of the processing activity (purposes, data, flows, retention periods, actors).
• An assessment of necessity and proportionality in relation to the purposes.
• An evaluation of the risks to the rights and freedoms of individuals (unlawful access, alteration, disappearance).
• The measures envisaged to address the risks and demonstrate compliance (security, safeguards, rights).

DPIA, FRIA and AI impact assessment

The DPIA has spread widely: it directly inspires impact assessments under other frameworks, with which it can be integrated.

• FRIA (AI Act): fundamental rights impact assessment for certain high-risk AI systems.
• AI system impact assessment (ISO 42001): similar logic, management-oriented.
• Consolidation: a high-risk AI processing activity may require both a DPIA and a FRIA, to be conducted jointly.
• Consistency: an integrated impact analysis is preferable to a series of redundant exercises.

What penalties apply in the event of non-compliance?

The absence of a DPIA when required, a superficial DPIA, or the failure to carry out prior consultation in the event of high residual risk constitute sanctionable breaches under the GDPR.

How to achieve compliance: the 6-step roadmap

Step 1 — Determine whether a DPIA is required

Compare the processing against the CNIL lists and the nine criteria. If at least two criteria are met, or if the processing appears on the list of required processing operations, the DPIA is mandatory.

When in doubt, carry out the DPIA: it is the most cautious and best-documented position.

• Check the CNIL lists (required / exempt).
• Assess the nine risk criteria.
• When in doubt, carry out the DPIA.

Step 2 — Describe the processing

Document purposes, categories of data and data subjects, flows, recipients, retention periods, processors and transfers. This description draws directly on your records of processing activities.

An accurate description determines the quality of the entire analysis.

• Describe purposes, data and flows.
• Identify actors, retention periods and transfers.
• Draw on the corresponding processing record entry.

Step 3 — Assess necessity and proportionality

Verify that the processing is necessary for its purpose and proportionate: legal basis, data minimisation, retention periods, information provision, exercise of rights. Rule out superfluous collection.

This is the legal component of the DPIA: it determines the very legitimacy of the processing.

• Justify the legal basis and purpose.
• Check minimisation and retention periods.
• Ensure information provision and exercise of rights.

Step 4 — Assess the risks

Identify the risks to individuals (unauthorised access, unwanted modification, loss of data), their sources, severity and likelihood.

Reason from the perspective of the data subjects, not just the organisation.

• Identify the feared events and their impacts.
• Assess the severity and likelihood of each risk.
• Prioritise the highest risks.

Step 5 — Define mitigation measures

Determine the measures that reduce each risk: security (encryption, access controls, logging), legal safeguards, minimisation, transparency. Re-evaluate the residual risk after measures are applied.

The objective is to bring risk down to an acceptable level.

• Associate measures with each identified risk.
• Re-evaluate the residual risk after measures are applied.
• Document decisions and trade-offs.

Step 6 — Validate, consult and review

Have the DPIA validated (including the DPO's opinion), gather the views of data subjects where appropriate, and consult the CNIL if the residual risk remains high despite the measures applied. Revise the DPIA whenever changes occur.

The DPIA is a living document, not a fixed deliverable.

• Gather the DPO's opinion and formally validate.
• Consult the CNIL if the residual risk remains high.
• Revise the DPIA in the event of any significant change.

Common mistakes to avoid

• Failing to carry out a DPIA when it is mandatory — one of the most frequently sanctioned breaches.
• Conducting a superficial DPIA that does not actually reduce any risk.
• Performing the DPIA after the processing has launched, when it must be carried out beforehand.
• Reasoning solely from the organisation's perspective, overlooking the data subjects.
• Neglecting prior consultation with the supervisory authority when residual risk remains high.
• Never revising the DPIA despite changes to the processing activity.

How Data Comply One supports you

Data Comply One guides you through your DPIAs with a step-by-step method and pre-filled templates, linked to your processing register: description, necessity, risks, measures and residual risk are all structured within the platform.

Two modes are available: carry out your DPIAs yourself using the software, or outsource them to our experts — an outsourced DPO — who complete them on your behalf directly on the platform and manage the prior consultation with the supervisory authority where required.

Since the method extends naturally to the AI Act's FRIA and the ISO 42001 impact assessment, you avoid repeating the same exercise three times for your AI-related processing activities.

Where do you stand? ·