DPIA Triggers
When is a DPIA mandatory?
TL;DR
A DPIA obligation arises where a processing is likely to result in a high risk to rights and freedoms. Specified in Art. 35(3) plus supervisory authority black/white lists plus the Art. 29 EDPB guidelines.
What are DPIA triggers?
Mandatory triggers (Art. 35(3)):
- Systematic evaluation producing legal effects
- Special category data on a large scale
- Systematic monitoring of publicly accessible areas
The binding list of processing operations requiring a DPIA (Art. 35(4) GDPR) is issued by the competent supervisory authority in each case — not by the Federal Commissioner for Data Protection (BfDI). Typical listed examples: employee tracking, AI recruiting, fitness trackers, smart cities.
Practical example
HR tool with AI-based evaluation: the trigger 'systematic evaluation producing legal effects' is met → DPIA mandatory. Effort 8-15 person-days (practical experience value, not a statutory requirement), documented in accordance with Art. 35(7).
Legal position in Germany and Austria
The substantive DPIA obligation follows uniformly across the EU from Art. 35 GDPR and applies in the same way in Germany and in Austria. The binding mandatory lists and exemption lists (Art. 35(4) and (5) GDPR) are, however, issued by the competent national supervisory authority — only the body issuing the list differs:
- Germany: For the non-public (private sector) sphere, the mandatory list comes from the Länder data protection authorities, or jointly from the Data Protection Conference (DSK mandatory list, V1.1, 10/2018) — not from the BfDI. Under § 9 of the German Federal Data Protection Act (BDSG), the BfDI is responsible only for federal public bodies and certain telecommunications and postal service providers; private sector processing falls under Länder supervision (§ 40 BDSG).
- Austria: The Austrian Data Protection Authority (Datenschutzbehörde, DSB) issues the lists by regulation — the DSFA-V (blacklist, BGBl. II Nr. 278/2018) and the DSFA-AV (exemption/white list, BGBl. II Nr. 108/2018).