DPIA — Data Protection Impact Assessment: when is it required, and when can you skip it?

A DPIA sounds like something only large enterprises need to worry about. For SMBs it's rarely required — but there are a handful of specific situations where it is. Here's the decision tree.

A DPIA is a structured risk analysis for processing activities that carry a high privacy risk. The Dutch Data Protection Authority (AP) publishes a list of situations in which a DPIA is mandatory.

When is it mandatory?

\n
• Large-scale processing of "special categories" of data (medical data, ethnic origin, religion).
\n
• Systematic monitoring of publicly accessible areas (CCTV at a central location).
\n
• Profiling with legal consequences for individuals (automated decision-making).
\n
• Biometrics used for identification (fingerprint lock, facial recognition).
\n
• Large-scale location tracking.
\n
• Combining personal data from different sources (data matching).
\n

When is it probably not required?

\n
• Standard HR administration.
\n
• Standard customer CRM.
\n
• Invoicing.
\n
• Newsletter with explicit consent.
\n

How do you carry out a DPIA?

\n
1. Description of the processing activity: why, how, and what data.
\n
2. Assessment of necessity and proportionality.
\n
3. Risk identification for the individuals involved.
\n
4. Measures to mitigate the risks.
\n
5. Residual risk and final assessment.
\n

Who should you consult?

\n
• Your Data Protection Officer (DPO), if one is in place.
\n
• The individuals concerned (employee representatives for HR-related processing).
\n
• Management signs off on the outcome.
\n

Prior consultation with the AP

If a significant residual risk remains after the DPIA, you are required to consult the AP BEFORE starting the processing activity. Typical turnaround: 6–10 weeks.

See also: GDPR pillar, risk management.