A DPIA is the written record of a decision you make before launch.

Most teams do not need a DPIA for every release. They need a screening step that runs on every release. The Article 29 Working Party, whose DPIA guidelines the European Data Protection Board (EDPB) later endorsed, listed nine signs that processing may be high risk. Where a plan shows two of them, the guidance treats a DPIA as the normal outcome.

Keep the screening result even when it says no. A one-paragraph negative screening is the evidence that you asked the question.

Automated evaluation with serious consequences

Systematic and extensive assessment of people, including profiling, that drives decisions with legal or similarly serious effects on them.

Sensitive data in bulk

Large-scale processing of the special categories in Article 9, or of data on criminal convictions and offences.

Watching public spaces at scale

Systematic monitoring of a publicly accessible area on a large scale.

Each supervisory authority must also publish a list of processing types that always need a DPIA, and may publish a list of types that never do. Check the list of every authority whose residents you serve, because they differ.

• A clear picture of the processing. What data, from whom, for what purpose, through which systems and vendors, and the legitimate interest relied on where there is one.
• A necessity test. Why this much data, for this long, is needed for the purpose, and why a lighter design would not do.
• The risks to people. Likelihood and severity of harm to the individuals, judged from their position.
• The measures. Safeguards, security controls and design changes that reduce those risks, and how you will show they work.
• The DPO's advice. Where you have a data protection officer, their view must be sought and recorded.
• People's views, where appropriate. Feedback from those affected or their representatives, such as a staff council for a monitoring tool.

1. Your measures are in place, and the assessment still shows a high residual risk to people.
2. You submit the DPIA to the supervisory authority for prior consultation before processing starts.
3. The authority has up to eight weeks to give written advice, extendable by six weeks for complex cases.
4. If it finds the plan would break the GDPR, it can use its corrective powers, up to banning the processing.

• Written after launch. A DPIA dated after go-live documents a decision nobody made.
• Copied from the last one. Generic text with the product name swapped shows no real thinking about this processing.
• No change to the design. If the assessment found nothing to adjust, reviewers ask whether anyone looked.
• No named owner. Measures without an owner and a date rarely get built.

For AI features, an ISO 42001 AI impact assessment covers wider effects on society and can run in the same workflow, but it does not replace the GDPR document.

Sources: Regulation (EU) 2016/679 (GDPR), Articles 9, 10, 35 and 36; Article 29 Working Party, Guidelines on Data Protection Impact Assessment (WP248 rev.01), endorsed by the EDPB.