A DPIA, or data protection impact assessment, is the risk assessment the GDPR requires before you start processing personal data in a way that is likely to put people's rights at high risk. In the Netherlands, the national data protection authority has also published a list of processing types for which one is always mandatory.
If you run security, DPIAs will land on your desk sooner or later. Most of the measures an assessment relies on are security controls, and its quality depends heavily on who writes it.
What is a DPIA under the GDPR?
Article 35 of the GDPR requires the controller, the organisation that decides why and how personal data is processed, to assess the impact of planned processing before it begins whenever that processing is likely to result in a high risk to individuals. A single assessment can cover a set of similar operations with similar risks, which helps if you are rolling out the same system across several sites.
The same article sets the minimum content. You need a systematic description of the processing and its purposes, an assessment of whether it is necessary and proportionate, an assessment of the risks to the people whose data it is, and the measures you will take to address those risks. Security measures sit squarely in that last part, which is why the CISO's team ends up supplying much of the substance.
When is a DPIA mandatory?
The GDPR names three cases where a DPIA is required in any event. One is systematic and extensive evaluation of people based on automated processing, including profiling, where decisions with legal or similarly significant effects follow. Another is large-scale processing of special category data, such as health data, or of criminal offence data. The third is systematic monitoring of publicly accessible areas on a large scale.
Each national supervisory authority also had to publish its own list. The Dutch authority, the Autoriteit Persoonsgegevens (AP), did so in 2019 in a formal decision listing 17 types of processing that require a DPIA. They include fraud prevention, credit scoring, camera surveillance, location data, profiling, biometric data and employee monitoring, which the AP illustrates with examples such as reviewing staff email and internet use or tracking company cars by GPS.
The list is explicitly not exhaustive. Processing that does not appear on it can still require a DPIA if its nature, scope, context and purposes create a high risk. For each item, the AP notes which of nine European criteria apply: evaluation or scoring, systematic monitoring, sensitive data, large-scale processing, combining datasets, vulnerable data subjects and innovative technology among them. My advice is to assume you need a DPIA as soon as your processing meets more than one of those criteria.
What happens if the risk stays high?
If the DPIA shows that the processing would still carry a high risk without further measures, Article 36 requires you to consult the supervisory authority before you start. Where the authority considers the processing would breach the GDPR, it has up to eight weeks to give written advice, extendable by six weeks for complex cases.
Build that into the project plan. A DPIA finished the week before go-live that ends in prior consultation can push the launch back by as much as fourteen weeks.
Nor is a DPIA ever really finished. The controller has to check that processing still follows the assessment, at the very least when the risk changes. A new supplier, an extra data source or a link to an AI model are all good reasons to reopen it.
Skipping a mandatory DPIA can get expensive. Under Article 83, breaches of obligations including Articles 35 and 36 can attract fines of up to 10 million euros or 2 per cent of worldwide annual turnover, whichever is higher.
Who should carry out a DPIA?
Legally, the DPIA belongs to the controller. If you have appointed a data protection officer (DPO), you must seek their advice, and Article 39 gives the DPO the task of advising on the DPIA and monitoring how it is carried out. Suppliers acting as processors are obliged under Article 28 to help you with it, so ask early for their information on hosting, access and security.
In my view, the owner of the processing should write the DPIA: the process owner or product owner who wants the processing to happen. A privacy officer guides the process and keeps the method sound. Someone who understands the system technically, often a security architect or the application manager, fills in the risks and controls. The DPO reviews the result.
A DPO who drafts the DPIA ends up reviewing their own work, and European regulators flag exactly that. In its January 2024 report on the position of DPOs, the European Data Protection Board (EDPB) lists DPOs drafting DPIAs among the examples of potential conflicts of interest. I set out why public bodies in particular should keep the roles apart in DPO vs privacy officer.
The EDPB's own thinking points the same way. In April 2026 it put a DPIA template out for consultation that asks you to record which team carries out the assessment and who holds which role. Using the template is optional, and you can keep your own methodology.
A practical way to run a DPIA
- Check early in the project whether a DPIA is needed: does the processing fall under Article 35(3), is it on your national authority's list, or does it meet several of the criteria?
- Describe the processing: what data, about whom, for what purpose, in which systems and with which suppliers.
- Test necessity and proportionality. Could you do it with less data, or another way?
- Map the risks to the individuals concerned. Risk to the organisation is a separate exercise.
- Record the measures, security included, and decide what residual risk remains.
- Ask the DPO for advice and document what you did with it.
- If residual risk is still high, consult the supervisory authority before going live.
For algorithms used by Dutch public bodies, the DPIA often runs alongside the IAMA, a Dutch human rights impact assessment for algorithms. I explain how the two fit together in my piece on the IAMA.
No capacity for DPIAs?
If DPIAs are piling up and nobody has the time, an interim privacy officer can clear the backlog and set up a way of working your own team can run afterwards. The profiles we place, from privacy officer to DPO, are on our page about hiring privacy officers and DPOs, and we find freelance specialists through MVPeople. Not sure whether your processing needs a DPIA, or who should write it? Call or email me.
