Structured methodology, mandatory elements and 7-step workflow for an effective DPIA.
Article 35(7) of the GDPR establishes the elements that every DPIA must contain.
Systematic description of processing, its purposes, data categories and subjects, recipients, retention periods.
Analysis of necessity and proportionality of processing given its purposes. Is there a less intrusive alternative?
Systematic identification of risks to data subjects' rights and freedoms. Probability and severity of each risk.
Detailed description of technical and organisational measures to reduce identified risks (pseudonymisation, encryption, access control, etc.).
Consultation with DPO, IT/security experts, business units, and data subjects' perspective where appropriate.
Clear definition of responsibilities for implementing mitigation measures and ongoing monitoring.
Follow a structured 7-step approach for a complete and documented DPIA.
Determine whether DPIA is mandatory by analysing Article 35(3) criteria and national guidelines. Describe the scope of processing, purposes, data categories and subjects. Gather basic information about technologies used and operational context.
Document in detail: (a) Data flow and systems description; (b) Actors involved (Controller, Processor, DPO, etc.); (c) Legal bases and legitimacy; (d) Consent mechanisms (if applicable); (e) Retention periods; (f) Existing security measures.
Using structured methodology (EDPB WP248 or CNIL), identify potential risks: (a) Unauthorised access or data breach risk; (b) Risk of arbitrary exclusion of data subjects; (c) Risk of discriminatory profiling; (d) Risk to privacy. Evaluate probability and severity of each risk.
For each identified risk, define technical (encryption, pseudonymisation, access control) and organisational (training, policies, audits) measures. Prioritise measures according to acceptable residual risk level.
Involve the Data Protection Officer (mandatory) and relevant specialists (IT, Security, Legal). Collect opinions and integrate them into the final DPIA. DPO must assess the adequacy of proposed measures.
If DPIA indicates high residual risk, perform prior consultation with the Supervisory Authority under Article 36. Authority responds within 30 days.
Obtain formal approval from Controller and DPO. Document entire DPIA clearly and accessibly. Establish periodic review schedule (annually or when material change occurs). Monitor measure implementation.
There are several internationally recognised methodologies for structuring DPIA implementation.
| Methodology | Origin | Description |
|---|---|---|
| CNIL (France) | Commission Nationale de l'Informatique et des Libertés | French methodology with structured 3-dimensional risk matrix (threats, vulnerabilities, consequences). Widely used internationally. |
| ICO (UK) | Information Commissioner's Office | Pragmatic approach focused on demonstrating compliance. Emphasises clear documentation and consultation with data subjects. |
| ISO 29134 | International Organization for Standardization | International standard defining DPIA structure, methodology and elements. Applicable in any regulatory context. |
| EDPB WP248 | European Data Protection Board | Opinion detailing 9 risk assessment criteria and prior consultation procedures. Official European guidance. |
A complete DPIA should produce the following documents and artefacts.
Summary for management: processing description, identified risks, proposed measures, compliance conclusion.
Complete analysis documentation including risk matrix, vulnerability assessment and proposed security measures.
Independent opinion from Data Protection Officer on the adequacy and compliance of DPIA.
Implementation schedule for mitigation measures, responsibilities, required resources and review schedule.
Documentation of internal consultations (experts) and, where applicable, prior consultation with Authority.
Formal decision by Controller to authorise or condition processing implementation.
Different types of DPIA may require methodological adaptations depending on specific context.
Visit the Common Types page for specific guides on:
DPIA is not a static document. It should be reviewed periodically or when context changes.
When to Review DPIA:
Maintain a record of all DPIA versions and review dates.
The Data Protection Officer plays a central role in DPIA implementation.
Under Article 39 of the GDPR, the DPO:
You now understand DPIA methodology. Explore specific types or request professional services.
Audiqcer offers professional DPIA conducting, reviewing and training services.
Describe your processing context to receive personalised recommendations and effort estimate.