5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Data protection impact assessment for data projects
A good DPIA leads to a decision.
We check whether your planned processing requires a DPIA under Art. 35 GDPR, assess risks and measures and prepare an approval that holds up before the data protection officer, customers and the authority.
Please enter a short description first.
The first contact is free of charge. We will expressly inform you in advance of any costs.
Response within 24 hours on working days
As of: 23 October 2026
DPIA pre-check: applicant selection with AI2 of 6
- Processing and purpose describedPresent
- Evaluation of individuals (scoring)Ranking of applicationsCheck
- Employment contextApplicants can hardly avoid itPresent
- Measures reduce the riskHuman review not regulatedMissing
- Residual risk assessedMissing
- Data protection officer consultedCheck
Point of review: Without human review, the risk remains high
- 1Describe the projectTool, data, launch
- 2Classify the riskObligation and risk picture
- 3Secure approvalReport and measures
Schematic illustration of a DPIA pre-check. Simplified example.
We review projects in
- AI and automation
- HR
- Web analytics
- Platforms
Key points at a glance
- Under Art. 35 GDPR, a data protection impact assessment is required if planned processing is likely to result in a high risk to the rights and freedoms of individuals.
- It must be in place before processing starts.
- At ITMR, we check the obligation, assess risks and measures and prepare an approval decision.
- If a high risk remains despite measures, we clarify prior consultation of the supervisory authority under Art. 36 GDPR.
- Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
- DSFA
- Data protection impact assessment under Art. 35 GDPR. It assesses the risks of a processing operation before it starts.
- SaaS
- Software as a Service. Software used over the internet rather than installed.
- VVT
- Record of processing activities under Art. 30 GDPR. It lists which data is processed for which purpose.
Reason for instruction
When does approval depend on the risk assessment?
In our experience, a DPIA becomes urgent shortly before launch: when a tool is about to be rolled out, the data protection officer stops it or a major customer demands evidence.
The decision against a DPIA should also be documented.
A privacy text with general safeguards is then not enough. Your company must be able to explain which processing is planned, why it is necessary, which risks arise and which measures reduce them.
In the end, the question is whether a remaining residual risk is acceptable. The DPIA is therefore not a policy paper but a review before approving a specific processing operation.
The threshold is "likely to result in a high risk". Anyone who claims a DPIA is not needed without reviewing the processing, data types, data subjects, technology and measures creates a target for later challenge.
- For whom
- Companies with data projects awaiting approval
- Provision
- Art. 35 and Art. 36 GDPR
- Timing
- Before processing starts
- Involvement
- Advice of the data protection officer under Art. 35(2) GDPR
Clear assessment before launch
Describe your project in the form. We will get back to you on working days within 24 hours with a first assessment and the next step.
How it works
How does the DPIA work in three steps?
We align the timetable with your planned launch.
01
Describe the project You describe the tool, process, data types, purpose, data subjects, service providers, planned launch and the open approval question.
02
Classify the risk We check whether a DPIA is necessary or advisable, which risks count legally and which documents must be available.
03
Secure approval You receive the DPIA report, catalogue of measures, coordination with the data protection officer, a decision paper and, if needed, the prior consultation.
What you have after the review
- 1
Obligation classified We clarify whether a DPIA is needed, whether a documented pre-check is enough or whether the project should be adjusted first.
- 2
Risks and measures prioritised We show which risks to data subjects count and which technical, organisational, contractual or procedural measures reduce them.
- 3
Approval line You receive a clear recommendation: approve, adjust, stop, document retrospectively or involve the authority.
How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.
Service package
What do you have in hand after the DPIA?
Service package: data protection impact assessment
Assessment of the obligation A clear assessment of the DPIA obligation under Art. 35 GDPR or documented reasons why it does not apply.
Auditable risk assessment A traceable assessment instead of generic data protection phrases.
Prioritised measures Concrete measures for IT, product, HR, marketing, procurement or compliance with clear responsibility.
Decision paper A paper for the data protection officer and management with residual risk and recommendation.
External line Answers for customer questions, audits, supplier assessments or communication with authorities.
- For whom
- Companies with data projects awaiting approval
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Technical security tests and proceedings before the authority after an objection. These are separate services, on request.
Who delivers what and who decides
- Project description and timetable
- Data flow or system diagram
- Provider documents
- Contacts in IT and the business unit
- Obligation check
- Risk assessment
- Catalogue of measures
- DPIA report and decision paper
- Your management decides on approval
- In a prior consultation, the supervisory authority
How does the engagement work?
- 1
First assessment You describe your project using the form. We assess whether a DPIA is likely needed. The first contact is free of charge.
- 2
Offer Before work begins, we tell you the scope and costs transparently.
- 3
Court steps separately We agree court proceedings and representation before supervisory authorities separately if you wish.
Occasions for a mandate
What do clients come to us with?
These are the six situations we see most often.
A project involving AI, HR, web analytics, a platform or SaaS is to be approved at short notice.
The data protection officer demands a traceable DPIA before launch.
A corporate customer, investor or auditor asks about the DPIA, technical measures, RoPA and DPA.
The processing concerns employees, special categories of data, profiling, scoring or systematic monitoring.
Product team, legal department, compliance and IT assess the same processing differently.
A supervisory authority asks questions about the risk assessment or missing documentation.
Obligation check
When is a DPIA more than an option?
We check the obligation particularly closely in these six constellations.
Systems evaluate, sort or prioritise people, predict behaviour or prepare decisions. The risk cannot be dealt with by a privacy policy.
People analytics, productivity tools, monitoring or security analytics are sensitive because employees can hardly avoid the system.
Usage profiles, cross-channel evaluation, segmentation, retargeting or fraud detection need consistent purposes, data flows and risk assessment.
Health, location, payment or communication data increase the pressure to justify when scope, access and storage period become intrusive.
Major customers want to see that risky processing has been identified, assessed, controlled and documented.
If data subjects, the works council, a customer or the authority ask questions, the DPIA becomes the line of defence: what was reviewed when, and why was it approved?
Points of attack
Where do DPIAs fail in practice?
These are the four weaknesses we see most often in existing DPIAs.
If the processing is already fixed and the DPIA merely simulates agreement, it loses its preventive character. We review early enough for the result to influence project decisions.
Model logic, data flow, access, logging, storage locations and provider chains must be translated into legal terms.
Encryption, an authorisation concept or data minimisation help little if it remains open where the measure applies, who is responsible for it and which risk decreases.
If the RoPA, DPA, technical measures, privacy notices and DPIA describe different purposes or roles, a gap in evidence arises.
Residual risk and supervision
When does the DPIA become a regulatory risk?
If a high risk remains despite measures, the supervisory authority must be consulted in advance under Art. 36 GDPR. This changes timing, communication and responsibility. We clarify this transition early.
- Measures do not traceably reduce the risk
Data subjects can hardly recognise or avoid the processing Technology, provider or data flow remain unclear Sensitive areas such as HR, health, scoring or monitoring Internal departments contradict each other on approval The authority has already asked about the DPIA
Description of the tool, process or system Purposes, data types, data subjects, roles and recipients RoPA extract, data flow or system diagram DPA, technical measures, hosting and access model Timetable, launch pressure and previous assessment
DPIA and AI Act
How do we separate the DPIA from the AI Act assessment?
AI does not automatically make a DPIA necessary. But it increases the risk when personal data are used for evaluation, scoring, profiling or HR decisions.
For certain deployers of high-risk AI systems, Art. 27 AI Act requires a fundamental rights impact assessment. It is not identical to the DPIA under Art. 35 GDPR.
We combine both reviews so that there is no duplication and no gap between data protection, AI governance and approval.
You can use our DPIA check to make a preliminary assessment of whether your processing needs a DPIA. We carry out the binding review.
Legal framework
Which rules apply to the DPIA?
Under Art. 35(1) GDPR, the controller carries out a DPIA in advance if processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons.
Art. 35(3) GDPR names standard cases: systematic and extensive evaluation of personal aspects with legal effects, large-scale processing of special categories of data and systematic large-scale monitoring of publicly accessible areas. Under Art. 35(4) GDPR, the supervisory authorities publish lists of further cases.
Art. 35(7) GDPR sets out the minimum content: a description of the processing, an assessment of necessity and proportionality, an assessment of the risks and the planned remedial measures. Under Art. 35(2) GDPR, the advice of the data protection officer must be sought.
If the DPIA indicates a high risk that the controller does not mitigate, it consults the supervisory authority before processing under Art. 36(1) GDPR.
- General Data Protection Regulation (EUR-Lex) Art. 35 and Art. 36 GDPR on obligation, content and prior consultation.
- BfDI on data protection impact assessments Notes and list of processing operations for which a DPIA must be carried out.
- Article 29 Working Party guidelines on DPIA (WP 248) Criteria on when a high risk exists. Endorsed by the European Data Protection Board.
- AI Act (EUR-Lex) Art. 27 on the fundamental rights impact assessment for certain high-risk AI systems.
Limits
What does the DPIA not do?
The DPIA is a basis for decisions. Responsibility and approval remain with you.
- 1
No approval by us Your management decides on the launch. We prepare the decision and justify our recommendation.
- 2
No technical test Security tests are carried out by specialist service providers. We assess their results legally.
- 3
A retrospective DPIA remains open to challenge A DPIA done later is better than none. We then document why it is being done later and which adjustments follow.
Mistakes that undermine a DPIA
- The DPIA is only prepared after launch.
- The data protection officer is not consulted.
- Nobody is responsible for the measures.
- The decision against a DPIA is not documented.
Your contact
Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“…after about 2 weeks, my profile was open again and almost fully usable… After trying again and again for 4 years to find a solution through META support or on my own, and already despairing, this was the only right decision.” (translated from German)
“Uncomplicated, competent and fast support.” (translated from German)
“The ITMR lawyers gave me excellent advice on data protection for my website. Professional, friendly and tailored solutions. Any time again! Absolutely recommended!” (translated from German)
FAQ
What do companies ask about the DPIA?
When is a DPIA required under Art. 35 GDPR?
When planned processing is likely to result in a high risk to the rights and freedoms of individuals. We look closely at new technologies, profiling, scoring, systematic monitoring, sensitive data and cases on the supervisory authorities' lists.
Is a short internal pre-check enough?
Yes, if it documents traceably why no DPIA is needed. For AI, people analytics, web analytics, scoring, sensitive data or contact with authorities, a brief assessment without reasoning is too weak.
Must the DPIA be completed before launch?
Yes. Art. 35(1) GDPR requires the assessment in advance. Risks, measures, residual risk and the decision should be documented before approval.
What happens if a high residual risk remains?
Then the supervisory authority must be consulted in advance under Art. 36 GDPR. We clarify this early because it affects timing, communication and approval.
Does every AI project need a DPIA?
No. It is likely if AI processes personal data and can have significant effects on data subjects, for example through profiling, scoring, an employment context or sensitive data.
How does the DPIA relate to the AI Act?
For certain high-risk AI systems, a fundamental rights impact assessment under Art. 27 AI Act is added. It complements the DPIA but does not replace it.
Can a DPIA be carried out retrospectively?
A retrospective DPIA is better than none but remains more open to challenge. We then document why it is being done later, which risks exist and which adjustments follow.
What should our enquiry contain?
A short project description, the planned launch, purpose and data types, data subjects, providers involved, existing documents and the question on which approval depends.
Next step
Is your data project due for approval?
Describe the tool, process, purpose, data types and planned launch. We assess whether a DPIA is needed and turn the data protection question into a decision paper.
Helpful for your enquiry
- Short project description
- Planned launch
- Data types and data subjects
- Providers involved
You can also submit documents after our first response.
Have your DPIA case classified
Describe the project, purpose and planned launch. We assess whether a DPIA is needed and what to review first.
Helpful are a short project description, data types, data subjects, providers, the planned launch and existing documents.
Related services
Data protection law GDPR compliance, proceedings before authorities and data protection organisation.record of processing activities When the DPIA depends on an unclear RoPA.Data processing agreement Review service providers, sub-processors and hosting.Implement the AI Act AI obligations and fundamental rights impact assessment.Data protection audit Review and prioritise the overall data protection status.Help with the supervisory authority When the authority is already asking about the DPIA.KI-Compliance Secure your own AI tools.