Key points
- The GDPR data protection impact assessment (DPIA) assesses and controls the consequences of data processing for the rights and freedoms of natural persons.
- A DPIA is mandatory only for processing that presents a high risk, identified according to precise criteria and the guidelines of the CNIL (the French data protection authority).
- The main risk criteria include systematic monitoring, new technologies, large-scale processing of sensitive data and automated profiling.
- Processing that meets at least two of these criteria generally triggers the obligation to carry out an impact assessment.
- Some situations are exempt, but where there is doubt about whether a DPIA is needed, it is still advisable to carry one out.
- A rigorous, structured method ensures the review is complete and the measures taken are relevant to the risks identified.
The data protection impact assessment, also called a DPIA (AIPD in French) or GDPR impact assessment, is an essential step in achieving compliance with the General Data Protection Regulation. It aims to strengthen the protection of personal data and to demonstrate an organisation’s ability to respect the rights and freedoms of data subjects, particularly where there is a high risk. This structured process supports the identification and assessment of risks and the implementation of appropriate technical and organisational measures.
Definition and objectives of the GDPR impact assessment
The main purpose of the GDPR impact assessment is to anticipate and control the potential consequences of processing personal data for the rights and freedoms of natural persons. It is not only a legal obligation; it is also good practice that builds a culture of compliance in every organisation.
By precisely identifying the processing likely to generate a high risk, the controller shows its commitment to protecting privacy and strengthens the trust of the data subjects. The GDPR impact assessment is therefore part of a preventive approach that supports informed decisions on the processing envisaged.
When is a DPIA required under the GDPR?
The obligation to carry out a GDPR impact assessment does not apply to all data processing. The regulation targets processing that presents a high risk to the rights and freedoms of individuals. To identify it, EU rules provide precise criteria, supplemented by guidelines published by national authorities such as the CNIL.
Managing certain sensitive processing in a compliant way may call for dedicated support, in particular during CNIL audits and penalty proceedings. In these circumstances, it may be worth seeking specific legal support with CNIL audits and penalties to make your approach legally sound and anticipate regulatory requirements.
Main criteria that call for a DPIA
Certain operations are considered sensitive because of their nature, scale or purpose. The main criteria include systematic monitoring, the use of new technologies, large-scale processing of sensitive data (health, opinions, biometrics), and the large-scale cross-referencing of several sources of information.
As soon as processing meets at least two of these factors, it generally falls into the category that requires a GDPR impact assessment. Here are the main recognised criteria:
| High-risk criterion | Example of a matching situation |
|---|---|
| Systematic monitoring | Permanent video surveillance in a public place |
| Large-scale processing of sensitive data | Centralised management of hospital medical records |
| Automated profiling | Predictive systems for recruitment or credit decisions |
| Large-scale data collection | Geolocation of users of a consumer mobile app |
| Use of emerging technologies | Facial recognition for building access |
Exceptions and nuances
Some situations are exempt, in particular where the impact has already been assessed within a specific regulatory framework, or where the nature of the processing clearly entails no high risk. Precise knowledge of the regulations is needed to identify them correctly.
Where there is doubt about whether a GDPR impact assessment is needed, it is still advisable to carry one out. To provide proof of effective compliance, it can be useful to look at the ways to prove GDPR compliance in practice (in French), including documentation and the impact assessments carried out.
Methods and methodology for the GDPR impact assessment
A successful GDPR impact assessment relies on a structured approach with several steps. A rigorous methodology ensures the review is complete and the responses to the risks identified are relevant.
Various methods are recommended by the competent authorities (in particular the CNIL). Each organisation adapts the level of detail to the sensitivity of its processing, its context and its internal resources.
Key steps in the impact assessment methodology
A DPIA involves several complementary phases. Each one must be handled precisely to obtain an accurate and usable map of the processing under review.
- Describe the processing: list all the data concerned, the purpose pursued, the stakeholders and the planned data flows.
- Assess necessity and proportionality: check that the processing is justified, measured and respects the fundamental principles of the GDPR.
- Identify the risks: detect every scenario in which an infringement of rights and freedoms could occur, measuring the potential impact and the likelihood.
- Determine the technical and organisational measures: propose and document all the safeguards that address or reduce the significant risks observed, whether technical tools, procedures or contractual arrangements.
This step-by-step structure makes it easier to build the DPIA in from the design stage (privacy by design) and allows the assessment to be reviewed regularly throughout the life cycle of the processing.
Role of the controller and involvement of stakeholders
The controller leads the GDPR impact assessment. It brings together all the necessary skills: business teams, IT teams, the Data Protection Officer (DPO) and sometimes external providers specialising in security.
The active involvement of these stakeholders supports a relevant risk assessment and the choice of appropriate measures, both technical and organisational. Precise documentation of this collective work also feeds the mandatory record of processing activities.
Consequences of the impact assessment: practical obligations and recommendations
Once the risk assessment is complete, the controller must implement all the measures required to limit the exposure of the data subjects. The related documentation serves as a reference in any audit by the supervisory authority or in the event of a data breach.
Regular updating of the GDPR impact assessment is imperative, especially if the processing changes or new risks emerge (for example with an innovative technology or a wider scope). This updating is part of the proactive accountability encouraged by the EU legal framework.
Alert where a high residual risk remains
If the impact assessment shows that a high risk persists despite the measures taken, the controller must consult the supervisory authority before starting the processing. This prior consultation helps prevent major social, economic or reputational harm.
The authority may then issue further recommendations, or even restrict or prohibit certain aspects of the processing. Meeting this obligation is a direct condition of GDPR compliance and of the controller’s legal certainty.
Practical tools and good practice
Many tools exist to facilitate the GDPR impact assessment, from risk assessment matrices to sector guides drawn up by personal data protection experts. Using them makes the process more accessible, even for small organisations.
Adopting proven methods (CNIL templates or equivalents) and regular regulatory monitoring provide further assurance of compliance and resilience for information systems that process personal data.
Frequently asked questions on the GDPR impact assessment and its methodology
Who must carry out a GDPR impact assessment?
Any controller planning an operation likely to result in a high risk to the rights and freedoms of individuals must carry out a GDPR impact assessment. This legal obligation mainly concerns companies, associations and public bodies that regularly handle sensitive information or carry out large-scale automated processing.
Common examples include:
- Systematic monitoring of activities (video surveillance, geolocation)
- Automated profiling with legal effects
- Centralised processing of health data
What documents should you keep after a GDPR impact assessment?
After carrying out the GDPR impact assessment, you should keep:
- The detailed DPIA report
- The updated record of processing activities
- Minutes of meetings or exchanges relating to the approval of measures
- Documentation on the tools or templates used during the assessment
These documents serve as evidence in an audit by the authorities and make it possible to demonstrate GDPR compliance, including in any later audit.
How do you choose the right method for the GDPR impact assessment?
The choice of method depends on the type of processing, the nature of the data collected and the organisational context. The main recognised options are:
- Method proposed by the CNIL (France)
- International standards such as ISO/IEC 29134
- Sector approaches developed by professional federations
| Method | Main features | Intended users |
|---|---|---|
| CNIL | Guided approach, tools available online | French organisations |
| ISO/IEC 29134 | International standard, universal approach | Large groups, multinationals |
| Specific sector | Adapted to a particular line of business | Mutual insurers, banks, local authorities |
It is advisable to favour an approach that meets local expectations while taking into account the real complexity of the processing being assessed.
When should a GDPR impact assessment be reviewed or renewed?
A GDPR impact assessment must be updated as soon as an essential element of the processing changes: new technology, change of purposes, wider scope, or discovery of a major flaw in personal data protection.
In practice, a periodic review – every two to three years, for example – is worthwhile even without major change, in order to improve GDPR compliance and adjust the security strategy if needed.
