YTYK You think you know

Card 17 of 18 Accountability ●●○ Working knowledge

When a DPIA is mandatory

A data protection impact assessment is required where processing is likely to result in a high risk — and always for systematic extensive automated evaluation with legal effects, large-scale special-category data, or systematic monitoring of a public area.

Why it is like this

Some risks can only be managed before the system is built. The DPIA moves the assessment to design time, where changing the answer is still cheap.

Not to be confused with

A compliance document written after launch, or a one-off. It must be done prior to the processing and revisited when the risk changes; and if the residual risk stays high, you must consult the supervisory authority before going ahead.

In practice

Each authority also publishes its own list of operations that always require one — checking the local list is part of the trigger assessment, not an optional extra.

Source: Regulation (EU) 2016/679 (GDPR) — Article 35. Read on .

Predict Check yourself

A DPIA concludes the residual risk is still high after mitigation. What does Article 36 require before launch?

  1. Prior consultation with the supervisory authority.
  2. A board sign-off recorded in the DPIA.
  3. Notification of the affected data subjects.
  4. Nothing further — documenting the residual risk discharges the duty.
Show the answer

Prior consultation with the supervisory authority.

Prior consultation is the step people skip. It is also the one with teeth: the authority can advise, and can prohibit the processing.