When is a DPIA required?

In brief

An impact assessment is needed when treatment is likely to create a high risk to people's rights and freedoms.

The decision depends on the context, scale, data, surveillance and vulnerability of people. A tool or sensitive data does not automatically trigger the same conclusion in all cases.

What to prepare

• Objective and scope of the processing or mission.
• Actors, tools, suppliers and flows concerned.
• Documents, contracts and decisions already available.

The criteria that trigger a DPIA

Article 35 of the GDPR requires a data protection impact assessment when processing is likely to result in a high risk. European guidelines list nine criteria; processing that meets at least two of them generally requires a DPIA:

• Evaluation or scoring of people, including profiling.
• Automated decisions with legal or similarly significant effects.
• Systematic monitoring, for example of employees or a public space.
• Sensitive or highly personal data.
• Large-scale processing.
• Matching or combining datasets.
• Vulnerable people: employees, patients, children.
• Innovative use or new technology.
• Processing that prevents people from exercising a right or using a service.

What a DPIA contains

1. Description of the processing: purposes, data, people, recipients, retention and tools.
2. Necessity and proportionality: legal basis, minimisation, information and individuals’ rights.
3. Risk analysis: unauthorised access, unwanted modification, loss of data, and their consequences for people.
4. Measures: technical and organisational measures that bring the risk to an acceptable level, with owners.

If a high risk remains despite the measures, the supervisory authority must be consulted before the processing starts (GDPR Article 36).

When should it be done?

A DPIA is carried out before the processing starts, ideally while the project is being designed, when a technical choice or a vendor can still be changed. It must then be reviewed when the processing changes significantly: new purpose, new data, new vendor or a change of scale.

What about Morocco?

Morocco’s Law 09-08 has no mechanism identical to the GDPR DPIA. Some processing does require prior authorisation from the CNDP, particularly when it involves sensitive data. For a Moroccan company subject to the GDPR, for example because it works for European clients, the DPIA remains the reference method for documenting risk.

Frequently asked questions

Boundaries

This content provides general information. It does not constitute legal advice tailored to any particular situation.

Keep reading

• Call centre GDPR audit: prepare your Moroccan BPO for a client review
• DPA, SCCs and TIA: which transfer documents do you need?
• EU hosting with overseas support: GDPR access checks
• European client GDPR requirements: documents for Moroccan suppliers