What is a DPIA (Data Protection Impact Assessment)?

GDPR spells out—in Article 35—that a DPIA must contain at least four things:

1. A clear description of the planned data processing activities and the purposes of the processing.
    

2. An assessment of necessity and proportionality (that is, is the scope of data processing proportionate to the organization’s aims?).
    

3. An analysis of data protection risks to the people involved (called “data subjects” in the regulation).
    

4. Documented measures to reduce those risks.

Though GDPR is relatively new, firms have been conducting impact assessments and risk assessments of various types for decades, often to comply with legal requirements.

US law has required environmental impact assessments since the 1970s; 1990s privacy laws extended the idea to the notion of privacy impact assessments (PIAs). Data protection laws now extend the idea that firms should anticipate and mitigate against possible harms to the realms of data and data privacy.

The EU takes GDPR and its related DPIA requirement seriously, meting out fines to organizations that fail to implement DPIAs or otherwise exhibit noncompliance.

In 2019, for instance, a high school in northern Sweden faced a fine—Sweden’s first—when it implemented a pilot to conduct roll call by using biometric facial recognition technology. It did so without conducting a DPIA. The school was ultimately fined EUR 19,000, though observers noted that the maximum fine could have totaled almost EUR 1 million.¹ (Penalties under the GDPR reach up to EUR 20 million or 4% of a company’s annual global revenue—whichever is higher.)

One website tracks GDPR fines. As of April 2026, over 3,000 fines had been counted. Many of these fines specifically cite GDPR’s Article 35 (which concerns DPIAs) as a contributor to the fine. In one December 2025 example, a French firm was fined EUR 3.5 million, with an Article 35 infringement cited. The largest GDPR fine in history was issued to Meta by Ireland’s Data Protection Commission in 2023 for EUR 1.2 billion, though that case focused on data transfers, not impact assessments. 

GDPR.eu offers guidance on how to properly conduct a DPIA, complete with a template. However, it should be noted that conducting a DPIA is often only the beginning of a thorough risk management process. Fines sometimes result when a DPIA identifies potential risks and vulnerabilities, but a lack of real mitigations renders the DPIA a mere exercise. 

In the worst cases, a DPIA can serve as a paper trail proving a firm knew risks and did not adequately address them. At France Travail, the national employment agency, security measures spelled out in DPIAs were never put in place, leading to a major data breach. In January 2026, regulators fined France Travail EUR 5 million.²

Per GDPR, three situations always trigger a DPIA. 

First: When automated decision-making significantly affects people. An example would be a bank’s algorithm automatically rejecting a loan application based on profiling, where the legal basis for the decision comes under scrutiny.  

Second: Large-scale processing of sensitive data, which includes biometric data, political opinions and other types of data revealing intimate details of a person’s life. 

Third: Systematic monitoring of public areas on a large scale (like large camera networks in train stations or shopping centers). 

Beyond these automatic triggers, the EU guidance lays out nine criteria for identifying high-risk data processing activities that might require DPIAs. These criteria include evaluation or scoring of individuals, innovative use of new technologies, processing data about vulnerable people (like children) and combining datasets from different sources. 

Many firms follow a basic guideline: If processing operations hit two or more of these criteria, it would be prudent to perform a DPIA. 

The DPIA process starts by determining whether a full assessment is warranted, typically during the early stages of project planning. 

When an assessment is required, organizations typically map their relevant data processing activities in detail. These maps capture how personal data is collected, from whom, the purposes of the processing and how long data is retained. 

Risk analysis follows, with each potential harm arising from the data (financial loss, discrimination, reputational damage or even physical danger) evaluated for likelihood and severity. 

For every risk identified, the organization documents a mitigation. Mitigations can include technical safeguards such as encryption or access controls and organizational steps such as staff training or overall project design choices. GDPR directs companies to adopt the principle of data protection by design. In other words: data protection should be built into everything a company does rather than tacked on as an afterthought.   

After mitigation, there remains what regulators term “residual risk,” the risk that persists even after reasonable measures. If residual risk remains high, the organization must inform its national supervisory authority. 

Under the GDPR, some organizations must appoint a data protection officer (DPO)—an independent corporate officer in charge of GDPR compliance. Where DPOs exist, they often drive the DPIA process, or are at least consulted throughout. 

Stakeholders affected by the processing generally weigh in where feasible. Some regulators have tools that help streamline the DPIA process. In the case of the UK’s Information Commissioner’s Office (ICO), for instance, there is a free and downloadable DPIA template organized around seven steps. (Though the UK is no longer an EU member state, the UK has legislation highly similar to the EU’s GDPR, called UK GDPR.) France’s equivalent (CNIL, for “Commission nationale de l’informatique et des libertés”) has released open-source software. Spain’s authority has published on its site distinct templates for public agencies and private companies, as well as an extensive guide to risk management. 

Broadly, such tools and guides underscore that an effective DPIA process begins early and addresses individuals’ privacy and privacy risks from the start.