Most Common DPIA Types

📹 Video Surveillance / CCTV

Monitoring by video cameras in common areas is one of the most frequent DPIAs in organizations. This processing is mandatory to assess under Article 35(3)(c) GDPR when it involves systematic monitoring on a large scale. Video cameras capture indirect biometric data and enable tracking of behaviors, locations and movement patterns.

The EDPB (European Data Protection Board) classifies video surveillance as high-risk processing when there are no technical or time limitations. The proportionality principle is essential: installing cameras in transition zones is different from monitoring rest areas or sanitary facilities.

Image retention must be minimal and necessary (30–90 days in general), with clear policies on access, automatic deletion, and data subject rights. Access controls to recordings must restrict to authorized personnel with audited logs.

Legal Basis

• Article 35(3)(c) GDPR: Systematic monitoring on a large scale
• Article 5 GDPR: Principles of lawfulness, transparency and data minimization
• EDPB Category: High risk without technical privacy measures

Risks to Data Subjects

• Loss of privacy and intimacy in shared spaces
• Identification and tracking of sensitive behaviors
• Unauthorized access to recordings by third parties
• Disclosure to authorities without informed consent

Recommended Mitigation Measures

• Data minimization: Install cameras only in common access zones (entrances, corridors), not in privacy areas
• Privacy-enhancing technology: Implement automatic face blurring or real-time anonymization
• Limited retention: Automatically delete images after 30–90 days; longer retention only with specific justification
• Access control: Limit viewing to authorized personnel with audited logs; multi-factor authentication
• Visual notice: Clear signage informing of camera and responsible controller
• Data subject rights: Transparent procedure for access, correction and complaints
• Processing contract: With cloud storage or CCTV service provider

Next Step

If your organization has or plans video surveillance, obtain a specialized impact assessment:

🤖 Artificial Intelligence

AI systems that process personal data are subject to mandatory DPIA under Article 35(3)(a) GDPR. Assessment is particularly important in AI for automated decision-making (Article 22), classification, risk scoring, or predictive analysis. The opacity of machine learning models creates unique compliance challenges.

Simultaneously, the EU AI Regulation (AI Act, in force since January 2025) introduces its own AI risk classification. Applications such as recruitment, credit, or surveillance systems classified as "high-risk" require dual compliance: GDPR + AI Act. Article 27 of the AI Act integrates with DPIA requiring explainability and conformity audits.

Generative AI (LLMs) presents risks of training data leakage, bias, and lack of transparency about sources. Organizations must audit data used, define clear usage policies, and maintain control over which AI is used in which context.

Legal Basis

• Article 22 GDPR: Decisions based solely on automated processing
• Article 35(3)(a) GDPR: Mandatory DPIA for automated processing at large scale
• EU AI Regulation Article 27: Compliance for high-risk AI systems
• Cross-reference: aidf.pt — Impact Assessment for AI

Risks to Data Subjects

• Discriminatory or biased automated decisions
• Lack of transparency: not knowing how AI reached a decision
• Inability to contest automated decision without human intervention
• Use of sensitive data (gender, ethnicity, religion) without consent
• Training data leakage or model inversion

Recommended Mitigation Measures

• Training data audit: Ensure data is representative, free of historical bias, and legitimately processed
• Fairness testing: Verify model does not produce discriminatory outcomes by gender, ethnicity, or protected groups
• Explainability: Use techniques like SHAP or LIME to provide human-readable explanations of decisions
• Human intervention: Significant decisions (recruitment, credit) must have mandatory human review
• Right to contest: Clear procedure for data subjects to contest automated decisions
• AI Act compliance: For high-risk AI, implement registry, technical documentation, and independent audit
• Data governance: DPO and AI specialist collaborate on continuous assessment

Next Step

Specialized assessment of AI — integration of GDPR + AI Act:

📍 Geolocation

Tracking employee location (via GPS, mobile devices, beacons, WiFi) is a common processing that raises significant privacy concerns. Commercial vehicle fleet monitoring is standard, but real-time employee tracking beyond work-related travel can be considered excessive surveillance. Location data enables inference of sensitive behaviors: places of worship, medical offices, political associations.

Workplace location tracking (WiFi, RFID badges, or real-time location apps) requires a DPIA and clear purpose justification. Proportionality must be respected: tracking general building location is different from minute-by-minute movement tracking.

Telecommunication data (cell tower triangulation) or historical location data obtained from mobile service providers requires clearly identified legal basis (consent or legitimate interest with safeguards).

Legal Basis

• Article 6 GDPR: Lawfulness of processing (consent, contract, legitimate interest)
• Article 35 GDPR: DPIA generally mandatory for large-scale tracking
• ePrivacy Directive (2002/58/EC): Location in telecom context

Risks to Data Subjects

• Continuous surveillance and loss of personal autonomy
• Revelation of movement patterns and personal activities
• Possibility of movement analysis outside work hours (if data persisted)
• Inference of sensitive information (medical, religious, political locations)
• Discrimination based on movement patterns (geographic bias)

Recommended Mitigation Measures

• Scope minimization: Track only during work hours; disable outside hours
• Reduced granularity: Record location by zone (e.g., "Building A") instead of exact GPS coordinates
• Minimal retention: Delete historical data regularly (e.g., 30 days)
• Privacy-enhancing technology: Use indoor beacons with limited range instead of global GPS
• Granular consent: Employees may opt into locations for specific purposes (fleet safety vs. movement surveillance)
• Limited access: Only project managers or security have access to location data
• Clear information: Documented policies on tracking; right to contest

Next Step

💻 Employee Monitoring

Monitoring of IT activity (email, browsing, keystroke logging), productivity (screenshots, app tracking), or wearables (smart badges with movement, posture) is frequent in organizations and raises significant labor rights and privacy questions. Monitoring is particularly sensitive because it occurs during work hours where the right to privacy is reduced, but not eliminated.

National labor legislation may impose restrictions beyond GDPR: right to rest, communication confidentiality, or protection of union representatives. Excessive monitoring may violate freedom of thought or association (Article 12 EU Charter of Fundamental Rights).

Monitoring technologies (RPA software, IoT posture sensors, activity tracking) have evolved rapidly; DPIA must be done prospectively on real surveillance capabilities, not just intended use.

Legal Basis

• Article 6 GDPR: Employer legitimate interest must be proportional
• Article 4(11) GDPR: Consent invalid in labor power imbalance context
• National labor law: Employee rights to privacy, rest, freedom of thought
• Occupational Safety Directive (89/391/EEC): Employer duties of protection

Risks to Data Subjects

• Continuous surveillance reducing autonomy and psychological well-being
• Inability to communicate privately (including with unions or representatives)
• Disciplinary decisions based on incomplete or incorrect monitoring data
• Incidental revelation of sensitive data captured (health, religious beliefs)
• Stress and burnout caused by continuous surveillance

Recommended Mitigation Measures

• Proportionality: Monitoring only for high-risk roles (sensitive data access, physical security); not blanket monitoring
• Reduced granularity: Measure productivity by completed tasks, not keystroke/mouse movements
• Clear communication: Documented monitoring policy; employee consent (even without practical opt-out)
• Sensitive exclusions: Do not monitor union representative, medical, or legal communications
• Limited retention: Monitoring data deleted after 3–6 months if no violation evidenced
• Right of access: Employee has right to see monitoring data about themselves
• Management training: Training on legitimate monitoring use; transparency on real capabilities

Next Step