DPIA (Data Protection Impact Assessment)

Data protection impact assessment under Art. 35 GDPR — mandatory where a high risk is likely

26 April 2026 · Category: GDPR · Compliance-Kit

TL;DR

A data protection impact assessment (DPIA) is mandatory under Art. 35 GDPR where processing is likely to result in a high risk to the rights and freedoms of natural persons — for example systematic evaluation, large-scale processing of sensitive data, or systematic monitoring of publicly accessible areas.

What is a DPIA (Data Protection Impact Assessment)?

A DPIA is not mandatory for every processing operation. It applies only once a threshold analysis indicates a 'likely high risk'. The supervisory authorities publish mandatory lists (for example the DSK 'List of processing operations subject to a mandatory DPIA', 10/2018), which name the following indicators: systematic evaluation, large volumes of sensitive data (Art. 9), systematic monitoring, new technologies (AI, biometrics), vulnerable persons (children, patients), transfers of data to third countries without an adequacy decision.

Content of a DPIA (Art. 35(7)): description of the processing, necessity assessment, risk assessment, measures to mitigate the risk.

DPIAs in Germany and Austria

Art. 35 and Art. 36 GDPR apply word for word in Germany and Austria as directly applicable EU law. Only the national mandatory and exemption lists differ, as does the supervisory authority competent for consultation under Art. 36.

Germany

The governing instrument is the mandatory list of the German Data Protection Conference (DSK, 'List of processing operations for which a DPIA must be carried out', 10/2018). Consultation under Art. 36 GDPR is addressed to the competent state data protection authority, and for federal bodies to the Federal Commissioner for Data Protection (BfDI).

Austria

The DSK list is replaced by the regulation of the Austrian Data Protection Authority (Datenschutzbehörde) on processing operations for which a DPIA must be carried out (DSFA-V, BGBl. II Nr. 278/2018). In addition, the exemption regulation (DSFA-AV, BGBl. II Nr. 108/2018) acts as a whitelist setting out the processing operations for which no DPIA is required. In Austria, consultation under Art. 36 GDPR is addressed to the Austrian Data Protection Authority (DSB).

Practical example

An e-commerce company introduces an AI-based recommendation system that analyses usage patterns. A DPIA is carried out before putting it into service:

Systematic description: which data, from where, for what purpose, for how long
Necessity assessment: would a less intrusive approach be possible?
Risk assessment: profiling, risk of discrimination, repurposing
Mitigation: pseudonymisation, opt-out, bias testing, 90-day retention period
Consultation of the data protection officer, information of the works council

Frequently asked questions

When is a DPIA mandatory for AI systems?

A DPIA under Art. 35 GDPR is mandatory for AI systems as well where the processing — in particular using new technologies — is likely to result in a high risk to the rights and freedoms of natural persons (Art. 35(1) GDPR). This must be distinguished from the fundamental rights impact assessment (FRIA, Art. 27 AI Act): for high-risk AI under Annex III of the EU AI Act it applies only from 2 December 2027 (Art. 113 AI Act as amended by Regulation (EU) 2026/1744) and only to certain deployers — bodies governed by public law, private entities providing public services, and deployers of systems listed in Annex III point 5(b) and (c). On 2 February 2025, only the prohibitions under Art. 5 and the AI literacy obligation under Art. 4 applied, not Art. 27. Where an obligation of the FRIA is already met through a DPIA, the FRIA can refer to the relevant sections of that DPIA (Art. 27(4) AI Act).

Is a one-off DPIA enough?

No. The DPIA is a living document: where necessary, the controller carries out a review to assess whether the processing is performed in accordance with the DPIA — at least when there is a change in the risk represented by the processing operations (Art. 35(11) GDPR). Practice rhythm: a review every 12 months (not a statutory deadline).

Must the supervisory authority be consulted?

Only where the DPIA shows a high residual risk that cannot be controlled (Art. 36). Duration of the consultation: 8 weeks, extendable.