What is a DPIA, and when do you need one?

What it is

A DPIA describes the processing and its purposes, tests whether it is necessary and proportionate, assesses the risks to individuals, and sets out the measures to address them. It must be done before the processing starts, with the advice of the DPO if you have one. If high risk remains after mitigation, you must consult the regulator before going ahead. The DUAA 2025 left the DPIA duty unchanged.

When you need one

• Any processing likely to result in a high risk to individuals, taking into account its nature, scope, context and purposes, especially with new technologies. UK GDPR Art 35(1)
• Systematic and extensive evaluation of people based on automated processing, including profiling, that leads to decisions with legal or similarly significant effects. Art 35(3)(a)
• Large-scale processing of special category or criminal offence data. Art 35(3)(b)
• Systematic monitoring of a publicly accessible area on a large scale, such as CCTV or Wi-Fi tracking. Art 35(3)(c)
• Anything on the regulator's list: innovative technology, decisions on access to a service, large-scale profiling, biometric or genetic data, data matching, invisible processing, tracking, targeting children or vulnerable people, and processing that risks physical harm. Art 35(4); ICO list of processing requiring a DPIA

When you do not need one

• Processing unlikely to result in a high risk. Screen and record the decision.
• Processing very similar to an operation already assessed, where you can rely on that DPIA. Art 35(1)
• Where the legal basis is a law that already included a general impact assessment, unless the law says otherwise. Art 35(10)

Who is responsible

The controller, which must seek the DPO's advice and, where appropriate, the views of the people affected. Processors must help.

What it involves

1. Screen the project against the triggers above.
2. Describe the processing: what, why, how, who and how long.
3. Assess necessity and proportionality.
4. Identify risks to individuals and rate their likelihood and severity.
5. Decide measures to reduce each risk and record residual risk.
6. Get sign-off, integrate the outcomes, and review when anything changes.
7. If high risk remains, consult the regulator before processing (Art 36).

Timing

Before the processing starts, and reviewed whenever the processing or its risks change.

If it goes wrong

Regulatory

Failing to carry out a required DPIA, or to consult the regulator, breaches Arts 35 and 36. A breach of this duty sits in the standard tier of penalties: up to £8.7 million or 2% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice.

Criminal

No offence.

Civil

No freestanding claim for a missing DPIA, but if the unassessed processing causes damage, the person can claim compensation under Art 82 and DPA 2018 s.168.