when am I required to carry out a DPIA

A DPIA is mandatory for processing with high risk

A DPIA — a data protection impact assessment — is mandatory when processing is likely to result in a high risk to the rights and freedoms of the people whose data is being processed. This is not a fixed list of activities that is exactly the same everywhere, but an assessment that begins with the nature, scope, context and purpose of the processing. Large-scale processing of sensitive data, structural and systematic monitoring of people in a publicly accessible place, and processing that leads to automated decisions with significant consequences, are examples often cited as situations in which high risk is likely.

For a typical freelancer or SME that maintains customer data, personnel data or an accounting system, a mandatory DPIA is usually not called for — such processing is typically not large-scale or systematic enough to be considered high risk. As soon as processing takes place involving, for example, health data on a larger scale, camera surveillance in public spaces, or profiling that has consequences for individuals, that picture changes. Anyone who is uncertain whether processing falls into that category can best substantiate that assessment based on the same overview that is also being built for the processing register , because for each processing activity it is already documented what the purpose, scope and data involved are, and that is precisely the information that a risk assessment requires.

What this is based on: Article 6 GDPR and the supervisory authority

The obligation to conduct a DPIA follows from the GDPR and is linked to the lawfulness basis of Article 6 GDPR: only if a lawful basis for the processing has already been established is the follow-up question relevant whether that processing also entails high risk. Supervisory authorities provide further guidance on which processing activities are considered high risk in practice; in the Netherlands the Dutch Data Protection Authority does this with its own lists and explanations, while the supervisory authority in another Member State may use a slightly different list — what remains the same everywhere is the standard from the regulation itself, what differs is the national interpretation of which processing falls under it. Anyone who is uncertain whether his company needs a separate data protection officer due to the scope of the processing will find a starting point in the explanation on the dpo requirement, because these two questions — DPIA and dpo — often go hand in hand with the same scale and risk assessment of the processing.