When Is a DPIA Required? GDPR Requirements and Process

If your team is about to roll out a tool that tracks customer behavior, scores applicants, or handles sensitive information, you need to know whether GDPR requires a Data Protection Impact Assessment (DPIA) first.

A DPIA is a structured risk assessment that evaluates the privacy risks of a specific data-processing activity before it starts, required whenever that activity is likely to result in high risk to people's rights and freedoms. This guide walks through the specific triggers, a 60-second self-check, and the four-step process for conducting one.

You'll sometimes see “DPIA” and “PIA” used interchangeably, though they're not quite the same. For the definition and a full comparison, see our DPIA glossary entry.

When is a DPIA required under GDPR?

Under GDPR Article 35, you must carry out a DPIA before starting any processing activity likely to result in a high risk to individuals' rights and freedoms. In practice, that usually means one or more of the following applies to what you're planning:

1. Profiling or automated decision-making. You're using automated scoring, evaluation, or decision-making that produces legal or similarly significant effects on people, done on an ongoing basis rather than as a one-off.

2. Special category or sensitive data at scale. You're processing health, biometric, genetic, racial or ethnic origin, religious, or sexual orientation data, or criminal-offense data, on a large scale.

3. Systematic monitoring of a public area. You're systematically monitoring a publicly accessible area on a large scale, such as through connected cameras or location tracking.

4. Combining or matching datasets. You're combining or matching datasets from different sources in ways people wouldn't reasonably expect.

5. Processing data about vulnerable individuals. You're processing data about children, employees, or other vulnerable groups in a way that creates a power imbalance.

6. New or innovative technology. You're using new or innovative technology, or applying existing technology in a new way.

7. Processing that could restrict rights or services. The processing could stop someone from exercising a right, using a service, or fulfilling a contract.

EDPB guidance states that, in most cases, processing that meets two of these criteria is likely to require a DPIA. It's also worth checking whether your national supervisory authority, like the ICO in the UK, has published its own list of processing activities that automatically require one. The EDPB's guidelines on DPIAs are the most detailed reference if you want to work through the criteria in full.

What counts as “large scale” processing?

GDPR doesn't set a fixed number. Regulators weigh the number of people affected, the volume and range of data, how long you keep it, and how wide an area it covers. A hospital network's patient records are large-scale. A single small clinic's appointment book generally isn't, though it could still meet other criteria.

What counts as profiling or automated decision-making?

This means automated scoring or evaluation of personal traits, such as credit scoring or targeted advertising that goes beyond simple retargeting, done on an ongoing rather than one-off basis. It matters most when the profiling drives a decision with legal or similarly significant effect, like a loan denial, a hiring decision, or an insurance price.

What counts as systematic monitoring?

This covers ongoing observation or tracking rather than occasional data collection, such as location-tracking apps, workplace monitoring software, or CCTV paired with analytics. A one-time survey isn't systematic monitoring. A tool that watches behavior continuously is.

What is special category (sensitive) data under GDPR?

Under GDPR, special category data includes health information, biometric data used to identify someone, genetic data, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, and trade union membership. Data about criminal convictions and offenses is treated similarly, with its own extra safeguards.

Quick self-check: do you need a DPIA?

Use this as a quick initial check before working through the full criteria above.

When in doubt, document a short screening record. A brief note showing which criteria you considered and why you concluded a full DPIA wasn't needed creates a record of that decision.

How to conduct a DPIA

A DPIA doesn't need to be a 40-page document. GDPR and the EDPB's guidelines break it down into four practical parts.

1. Describe the processing

Document what's actually happening before you assess anything. Capture:

• What data you're collecting and its source

• How it's stored, secured, and for how long

• Who has access, internally and externally

• The purpose of the processing and its legal basis

• Where the data flows, including any third-party recipients

Example: A retailer rolling out a new loyalty app would document what purchase and location data it collects, where it stores it, who can access it, and why.

2. Test necessity and proportionality

Check whether this is genuinely the least intrusive way to achieve the purpose: is the data collected actually minimized, is there a valid legal basis, are individuals told what's happening in plain language, and can they exercise their rights over their own data.

Example: If the same personalization goal could be achieved with anonymized purchase categories instead of individual profiles, that's a sign the current approach may not be the least intrusive option.

3. Identify and assess the risks

Work through what could go wrong for the people whose data you're processing, not just for your organization:

• Loss of control over their own information

• Unauthorized access or a security incident

• Discrimination, financial harm, or reputational damage

• Physical safety risks in extreme cases

• Any consequence that would make a reasonable person uncomfortable

For each risk, estimate how likely it is and how severe the impact would be if it happened.

Example: For a hiring-screening tool, a realistic risk is an algorithm systematically scoring certain applicant groups lower because of biased training data.

4. Define mitigating measures

Match safeguards to the risks you found:

• Apply data minimization and shorten retention periods

• Strengthen security with encryption and access controls

• Use anonymization or pseudonymization where the purpose allows it

• Train staff and communicate clearly with the people affected

Example: Encrypting stored biometric data and limiting access to a small, named team reduces both the likelihood and impact of unauthorized access.

Document the DPIA itself, including any residual risk you're accepting and who signed off on it. The data controller is ultimately responsible for this decision, and if your organization has a Data Protection Officer, they should be consulted and that advice recorded, even though the final call sits with the business. Keeping DPIAs alongside your other privacy and legal records can also make them easier to retrieve and review as your processing changes. Clym's Governance Portal provides one place to manage this documentation rather than relying on scattered files and email threads.

Run the DPIA before processing begins, not after, and revisit it whenever the project's scope, technology, or risk profile changes materially. A DPIA written for an earlier version of the project won't hold up if a regulator asks about the current one.

The DPIA process at a glance

DPIA requirements outside the EU: US state laws

GDPR is no longer the only regime with this kind of requirement. Most comprehensive U.S. state privacy laws now include their own version, usually called a “data protection assessment,” for similar high-risk activities: targeted advertising, selling personal data, profiling with legal or similarly significant effects, and processing sensitive data. Clym's guides to the Texas Data Privacy and Security Act, the Montana Consumer Data Privacy Act, the Colorado Privacy Act, and the Connecticut Data Privacy Act each cover exactly when a data protection assessment is required under that state's law. California's 2026 CPRA regulations add a similar risk-assessment requirement for processing that presents significant consumer risk.

Not every state law includes this requirement, so check the specific law that applies to your business rather than assuming one standard applies everywhere. Clym's 2026 U.S. state privacy law comparison guide has the full state-by-state breakdown.

Common DPIA mistakes to avoid

Conclusion

A DPIA is a practical way to identify privacy risks before high-risk processing begins. If your project involves profiling, sensitive data, systematic monitoring, or new technology, start with the criteria above, document your decision, and review the assessment whenever the processing or its risks materially change.