When is a DPIA
required?

In brief

An impact assessment is needed when treatment is likely to create a high risk to people's rights and freedoms.

The decision depends on the context, scale, data, surveillance and vulnerability of people. A tool or sensitive data does not automatically trigger the same conclusion in all cases.

What to prepare

• Objective and scope of the processing or mission.
• Actors, tools, suppliers and flows concerned.
• Documents, contracts and decisions already available.

Boundaries

This content provides general information. It does not constitute legal advice tailored to any particular situation.