What is a data protection impact assessment (DPIA)?

DPIA: definition and obligation

The DPIA is a structured procedure in which companies check, before processing begins, which risks arise for the individuals concerned and how they can be limited. It is not required for every processing operation, only where a high risk is likely, above all when new technologies are used.

Art. 35(3) GDPR lists examples: systematic and extensive evaluation of personal aspects with significant effects (profiling), large-scale processing of special categories of data such as health data, and systematic large-scale monitoring of publicly accessible areas. The data protection authorities have also published lists of processing operations for which a DPIA is always required.

How a DPIA works

First, a preliminary check (threshold analysis) clarifies whether a DPIA is needed. If so, the company works through the steps that Art. 35(7) GDPR names as minimum content. A designated data protection officer must be involved; the results are documented and updated when the processing changes.

• Systematic description of the planned processing and its purposes
• Assessment of necessity and proportionality
• Assessment of the risks to the rights and freedoms of individuals
• Definition of remedial measures, safeguards and security measures
• Documentation, approval and regular review

Real-world example: GPS tracking in a vehicle fleet

A logistics company wants to equip its delivery vehicles with GPS tracking and analyze when drivers stop and where. This makes sense for route planning, but it also allows the behavior of individual employees to be monitored. The preliminary check shows an elevated risk, so a DPIA is carried out.

The result: tracking only during working hours, no evaluation of individual drivers without cause, short retention periods, access only for dispatch, information for employees and involvement of the works council where one exists. With these measures, the risk falls to an acceptable level and the processing can start.

Consultation, mistakes and limits

If a high residual risk remains despite countermeasures, the controller must consult the supervisory authority before processing begins (Art. 36 GDPR). A missing but required DPIA can be penalized as a separate violation with a fine. It is not a one-off formality: if purposes, technology or data types change, the assessment must be renewed.

• Carrying out the DPIA only after the system has gone live
• Filling in templates without a genuine risk assessment
• Assessing risks from the company’s perspective instead of that of data subjects
• No update after feature extensions or the use of AI

What companies should look out for

Build the preliminary check into every new system involving personal data, especially for AI, video surveillance, tracking or health data. Involve the business unit, IT and data protection early, because the DPIA must be in place before launch. Nano Concepts supplies technical descriptions, data flows and safeguards on which your data protection advisor can base the assessment. This article does not replace legal advice.