A DPIA, in full a data protection impact assessment, is a risk assessment you conduct in advance when processing personal data is likely to present a high risk to the individuals whose data is involved. The GDPR does not require this assessment for every processing, but specifically for processing that, by its nature, scope, context or purpose, may have significant impact — think of large-scale monitoring, systematic profiling, or processing of special categories of data such as health data on a large scale.
Whether your business must conduct a DPIA depends on what you actually do with the data, not on your size as a business. A sole proprietor who installs cameras on a small scale in a shop generally falls outside this obligation; an SMB that uses AI software to analyze customer behaviour on a large scale or screens job applicants is more likely to fall within the scope of a mandatory DPIA. The Dutch Data Protection Authority publishes a list of processing for which this assessment is always necessary according to its view; that list is a good starting point to determine whether your situation falls within it.
When does this apply to SMBs
Most SMBs escape a formal DPIA, simply because their processing does not have the scale or risk level that the GDPR means. Yet there are situations in which the question suddenly becomes relevant: the introduction of video surveillance with facial recognition, the use of a new AI tool that automatically makes decisions about customers or employees, or an expansion of existing software whereby you suddenly collect data on a much larger scale than before.
It is therefore not so much the sector that determines whether a DPIA is necessary, but the change in what you do. An HR department switching to a recruitment tool with automatic CV screening would do well to ask itself whether that switch falls within the criteria. The same applies to an office manager considering deploying a new SaaS tool that tracks visitor behaviour on the website and combines it with other data sources.
What should a DPIA contain
A DPIA systematically describes what happens: which data is processed, for what purpose, on what legal basis, and who has access to the data. Next, the assessment maps the risks to the individuals involved — what could go wrong, and how likely and significant is that impact. The final element is the measure: what technical or organisational steps are taken to reduce those risks, and is there still a risk remaining after those measures are put in place that cannot be eliminated.
That last point is important: if a DPIA shows that there is still a high risk remaining even after measures are in place, the GDPR requires you to submit this to the supervisory authority before you begin processing. This is an exception, not a standard step, but it is why a DPIA is not something you can simply fill in afterwards.
The relationship with the processing records
A DPIA does not exist in isolation from the rest of your GDPR documentation. The processing for which you conduct the assessment should also be recorded in the knowledge base where risks per processing are set out, so that it remains clear which processing require extra attention and which do not. If you already have your processing records in order, you will often see for yourself which processing, in terms of scale or sensitivity, come closer to the DPIA threshold than others.
It is also a good time to review the data processing agreements associated with this processing: an external party that processes the data for which you are considering a DPIA is often also the party where the greatest risks arise if something goes wrong. Just as with a possible data breach, it is useful to know where you stand in advance rather than having to find out afterwards exactly what was agreed.
What if you are unsure
The boundary between "probably no DPIA required" and "better analyse first" is not always clear, and the GDPR deliberately leaves room for your own assessment here. If in doubt, it is advisable to consult the guidelines of the Dutch Data Protection Authority or ask a lawyer to review your specific situation. This page describes the general approach in the regulation; it is not a substitute for that advice.
Would you first like to get an impression of how your own processing activities relate to the risk assessment used by the GDPR? Take the free quick scan or browse through the frequently asked questions about the records and monitoring thereof to see which step is most appropriate for your company.