DPIA Check

Does your project need a data protection impact assessment?

This interactive check gives a preliminary assessment of whether a data protection impact assessment under Art. 35 GDPR is indicated for processing personal data – for example with AI, scoring, profiling, video surveillance, health data, employee data, tracking, platform data or large-scale processing.

Start the check

Art. 35 GDPR Risk threshold Safeguards Documentation

What this check is for

The checker helps companies, product teams, data protection officers, HR, marketing, IT security and management to capture DPIA triggers, documentation gaps, safeguards and the next review path in a structured way.

Initial assessment of whether a DPIA obligation is likely or a threshold analysis is sufficient.
Review of typical risk signals: special categories of data, profiling, monitoring, new technologies, vulnerable data subjects and large volumes of data.
Comparison with the required evidence such as records of processing, data flow, role mapping, DPA, deletion concept, TOMs and risk analysis.
Preparation of a usable short description for your enquiry to a lawyer.

DPIA traffic light

From data project to a reliable DPIA decision

The DPIA traffic light counts live which of the nine criteria from the EDPB-endorsed guidelines WP248 rev.01 your answers touch, shows possible matches on the DSK must list under Art. 35(4) GDPR and names the next specific deliverables. The signals update automatically while you complete the questionnaire.

Not yet assessed

Answer the questionnaire. Rule of thumb under WP248 rev.01: if two or more criteria are met, a DPIA is generally required.

0 of 9 criteria under WP248 rev.01 touched

1Evaluation or scoring, profiling
2Automated decision with legal or similarly significant effect
3Systematic monitoring
4Sensitive or highly personal data
5Large-scale processing
6Matching or combining datasets
7Vulnerable data subjects, such as employees, children, patients
8Innovative use or new technology, such as AI
9Data subjects are prevented from exercising a right or accessing a service

DSK must list (Art. 35(4) GDPR)

No comparison possible yet. The list of the German Data Protection Conference (DSK) for the private sector (version 1.1 of 17.10.2018) is binding but not exhaustive.

Next deliverables

1Documented preliminary review (threshold analysis) with reasons, even if no DPIA is required – see Records of processing activities.
2DPIA report under Art. 35(7) GDPR: description, necessity, risks, remedial measures – see Data protection impact assessment.
3TOM and action plan with residual risk assessment – see Data protection audit.
4If the residual risk is high: prior consultation of the supervisory authority under Art. 36 GDPR before processing begins – agree the approach with ITMR.
5For AI: comparison with the AI Act (Art. 26(9), Art. 27) – see AI Act Check.

Context openProcessing context

0Risk factors

0Evidence

0Safeguards

Review path as text

The graphic shows the review path: first the processing context is clarified, then risk factors, evidence and safeguards are classified.

DPIA risk path in four stages: 1. Processing – purpose, data, data subjects. 2. Risk – profiling, monitoring, sensitivity. 3. Protection – TOMs, transparency, control. 4. Decision – DPIA, preliminary review, Art. 36. The result is DPIA evidence.

Decision rule of the traffic light: a match on the DSK must list or a standard example under Art. 35(3) GDPR means red (DPIA required). Two or more WP248 criteria mean red (DPIA generally required). One criterion means yellow (document the preliminary review, DPIA possible in individual cases). No criterion means green (document the threshold analysis). The traffic light is an orientation and does not replace an individual review.

Review logic

How the DPIA Check approaches the decision

Narrow down the processing

Purpose, data types, data subjects, systems, recipients and roles must be specific enough for risks to be assessable at all.

Identify triggers

Special categories of data, scoring, profiling, systematic monitoring, new technologies or large volumes of data often point towards a DPIA.

Review the evidence

Records of processing, legal basis, data flow, role mapping, DPA, deletion concept and privacy notices are typical basic building blocks.

Assess safeguards

Data minimisation, access protection, encryption, transparency, human review, tests and incident processes only reduce risks if they are actually implemented.

Decide on the residual risk

If a high risk remains despite the measures, prior consultation under Art. 36 GDPR is mandatory before processing begins, in addition to the DPIA; the residual risk assessment must be reviewed and documented.

Classification

What this check delivers

The check does not replace an individual legal review. It does, however, help to capture typical DPIA signals in a structured way and prepare the next documents for a reliable review.

What is a DPIA?

A data protection impact assessment is a structured risk analysis for processing that is likely to result in a high risk to the rights and freedoms of natural persons. It documents purpose, necessity, risks, safeguards and residual risk.

Which projects are typical DPIA candidates?

Typical DPIA candidates are AI and scoring systems, automated evaluation, systematic monitoring, video surveillance, health data, employee data, large volumes of data, tracking, profiling, data matching and processing of vulnerable persons.

What happens if a high residual risk remains?

If safeguards do not reduce the high risk sufficiently, prior consultation of the competent data protection authority under Art. 36 GDPR is mandatory before processing begins. This is a special escalation case: the authority has up to eight weeks, extendable by six weeks; this should be planned before go-live and documented properly.

Interactive questionnaire

Start the DPIA threshold analysis

Answer the following five steps. The result is a preliminary classification with reasons, priority, review points and a copyable enquiry summary.

1 of 5 steps

1. Which processing should be reviewed?

Choose the focus that comes closest to the project.

AI, scoring, profiling or automated evaluationEvaluation of persons, risk, credit, performance, behaviour, fraud, matching or recommendation systems. HR, employee data or employee monitoringApplicant management, AI in recruiting, time recording, productivity data, monitoring or internal communication. Video surveillance, access, location or publicly accessible areasCCTV, camera analytics, access control, visitor tracking, location data, area monitoring or sensors. Health data or special categories of personal dataHealth, biometric data, religion, political opinion, trade union membership, sexual orientation or comparably sensitive data. Tracking, behavioural advertising or extensive user analysisWebsite/app tracking, cross-device, remarketing, fingerprinting, analytics, consent mode, data warehouse or customer scoring. Platform, SaaS, app or data-driven productUser accounts, communication data, platform behaviour, community, marketplace, SaaS logs, API data or product analytics. Data matching, data pool or new data sourceCRM, data lake, data enrichment, data brokers, group-wide matching, identity matching or combining several systems. Only anonymous or aggregated dataAs things stand, no personal or re-identifiable data is processed. Unclear / new projectData flows, purposes, risks or roles have not yet been fully clarified.

3. What documentation is in place?

Select everything that is reliably documented.

Records of processing / processing activity documentedPurposes, categories, recipients, time limits, TOMs, legal bases and responsibilities are recorded. Purpose, legal basis and balancing of interests reviewedLegal basis, purpose limitation, legitimate interest, consent or statutory basis are justified. Data flow and system architecture describedData sources, systems, interfaces, storage locations, recipients, deletion and access points are traceable. Roles, DPA and service providers clarifiedControllers, joint controllers, processors, sub-processors and contracts are classified. Privacy notices and data subject rights preparedInformation, access, erasure, objection, complaint, contact route and internal processes are provided for. Deletion concept and retention periods definedRetention, deletion, archiving, backups, blocking and log data are regulated. DPO / data protection team was involvedData protection officer, legal, IT security, the business unit, works council or compliance were involved. DPIA draft or preliminary review existsThere is already a threshold analysis, risk analysis, DPIA template or list of measures. No structured documentation yetSo far there is only project information, tool documents or incomplete data protection documents.

4. Which safeguards are planned?

Select everything that is actually implemented or specifically planned.

Data minimisation and purpose limitationOnly necessary data, clear purposes, separate datasets, economical defaults and no purpose creep. Pseudonymisation, anonymisation or encryptionTokenisation, hashing, key management, encryption at rest/in transit or aggregated analyses. Access protection, role permissions and loggingMFA, authorisation concept, need-to-know, logging, admin control and regular reviews. Human review or ability to interveneNo purely automated decision, review, escalation, objection process or manual control. Transparency, choices and data subject controlClear information, opt-out, consent, settings, dashboard, withdrawal or easy exercise of rights. Tests, audit and effectiveness checksPen test, bias test, data protection test, security review, model/tool review, monitoring or re-evaluation. Incident, deletion and correction processData breach process, error correction, deletion runs, rollback, emergency measures and responsibilities. Risk analysis with likelihood and severityRisk scenarios, types of damage, likelihood, severity, measures and residual risk have been assessed. Safeguards not yet specifiedThere is general security or tool information, but no DPIA-specific assessment of measures.

5. Is there specific pressure to act?

Select everything that applies.

Go-live, rollout or tool approval is imminentThe processing is to go live, be introduced or be released to users/employees shortly. Processing is already runningThe tool, tracking, AI system, HR process, video surveillance or data pool is already live. DPO, legal, works council or customer requires a DPIAThe data protection officer, procurement, works council, customer, auditor or project team requests a DPIA or preliminary review. Supervisory authority, audit or complaintAn authority, data subject, customer, works council, auditor or data protection team asks specifically about the risk assessment. Data breach, wrong decision or data protection problemIncident, incorrect scoring, unauthorised access, model error, allegation of discrimination or complaint. AI, HR or particularly sensitive projectAI system, recruiting, employee data, health data, tracking or automated decision with high visibility. Residual risk could remain high despite measuresIt is uncertain whether safeguards reduce the risks sufficiently; prior consultation could become an issue. Preventive reviewNo acute case, but the DPIA obligation and data protection risks are to be clarified properly in advance.

Risk matrix

Typical DPIA signals, measures and deadlines

Signal	Why it matters	Typical measure	Timing
AI, scoring or profiling	Evaluations can have significant effects on people.	Review logic, data basis, human review, bias test and transparency.	Before go-live and in the event of a material change.
Health data or special categories	High intensity of intervention and increased need for protection.	Review legal basis, access, encryption, purpose limitation and deletion in depth.	Before processing.
Systematic monitoring	Control and behavioural risks can be high.	Assess necessity, alternatives, retention period, transparency and access protection.	Before introduction or expansion.
Tracking and user analysis	Profiling, device access and third-party providers can interact.	Review consent, TDDDG, third-country transfers, withdrawal, data minimisation and recipients.	Before a campaign, tool change or live operation.
Data breach or complaint	Evidence, risk assessment and communication become time-critical.	Review breach triage, 72h notification check, information of data subjects and DPIA evidence.	Immediately after becoming aware.
Data subject rights	Access, erasure and objection must work in practice.	Organise the DSAR process, identity verification, deadline control and documentation.	Usually to be answered within one month.

Sensible next steps

Related ITMR checkers and follow-up reviews

GDPR Role SimulatorClarifies controller, processor, joint controllership and roles in complex data flows. DPA CheckReviews service providers, sub-processors, processing on behalf and contract gaps as DPIA groundwork. Third-Country Transfer CheckPlaces cloud, US tool and international recipients within the data protection review. Data Breach Risk CheckHelps with incident triage, 72h notification check, risk assessment and communication needs. AI Act initial checkSupplements the DPIA review for AI systems, scoring, HR AI and automated evaluation. Document Dossier BuilderStructures evidence, risk analysis, records of processing, TOMs, role mapping and list of measures for an engagement or audit.

Get a reliable answer on the DPIA obligation

If a go-live is imminent, processing is already running, special categories of data are affected or AI, tracking, HR, platform data or video surveillance are involved, the DPIA decision should be documented in a traceable way.

Request a DPIA check from ITMR

Legal notice: this checker offers an initial orientation and does not replace an individual legal review. Whether a DPIA is required depends on the processing, purpose, data types, groups of data subjects, scale, risks, safeguards, roles and residual risk. How a full Data protection impact assessment works and how it fits into a Data protection audit is explained on the respective service pages.