DPIA: Data Protection Impact Assessments Explained

A DPIA (data protection impact assessment) is a documented risk assessment that GDPR requires before processing likely to put people's rights at high risk. Article 35 GDPR says the controller must carry it out before the processing starts. In practice, it is a structured document: what you plan to do with personal data, why, whether it is necessary, what could go wrong for the people concerned, and what you will do about it. If high risk remains after that, you must consult the data protection authority first.

An everyday example

"Example Clinic Ltd" (a made-up example) is a group practice with twelve doctors. It wants to use an AI tool to summarise incoming specialist letters and draft replies. The letters contain diagnoses, medication and family history.

Before switching it on, the practice writes a DPIA. It describes the data flow (letter in, summary out, which provider sees what), checks whether a less intrusive option would do the job, lists the risks (a leak, the provider reusing the letters, a wrong summary that goes unnoticed) and sets measures against each one: a data processing agreement, no training on its content, zero data retention at the model provider, a doctor reviewing every draft. The document is signed off and reviewed when the tool or the use changes.

The details, simply

When a DPIA is mandatory

The general rule (Art. 35(1)) is that a DPIA is needed where processing, "in particular using new technologies", is likely to result in a high risk to people's rights and freedoms. Art. 35(3) names three cases that always need one:

Systematic and extensive evaluation of people based on automated processing, including profiling, with decisions that have legal or similarly significant effects.
Large-scale processing of special category data (health, genetic, biometric and so on) or of criminal conviction data.
Systematic monitoring of a publicly accessible area on a large scale.

Beyond that, each supervisory authority publishes its own list of processing that needs a DPIA (Art. 35(4)), and may publish a list of processing that does not (Art. 35(5)). Check the list of your national authority.

The EDPB's nine criteria

European regulators use nine criteria, set out in guidelines the European Data Protection Board endorsed in 2018, to judge "likely high risk":

evaluation or scoring
automated decisions with legal or similar effect
systematic monitoring
sensitive or highly personal data
large-scale processing
matching or combining datasets
vulnerable data subjects (patients, employees, children)
innovative use of technology
processing that prevents people from using a service or exercising a right

As a rule of thumb, processing that meets two or more criteria usually needs a DPIA. If you decide you do not need one despite the indicators, write down why.

What a DPIA must contain (Art. 35(7))

At minimum:

A systematic description of the processing and its purposes, including any legitimate interest relied on.
An assessment of necessity and proportionality in relation to those purposes.
An assessment of the risks to the rights and freedoms of the people concerned.
The measures to address those risks: safeguards, security measures and ways to show compliance.

You must seek the advice of your data protection officer, if you have one, and where appropriate the views of the people affected or their representatives (Art. 35(9)). The DPIA is reviewed when the risk changes (Art. 35(11)).

Prior consultation (Art. 36)

If the DPIA shows a high risk that your measures cannot reduce, you must consult the supervisory authority before starting. The authority has up to eight weeks to give written advice, extendable by six weeks for complex cases.

Sanctions

Failing to carry out a required DPIA, or to consult the authority, falls in GDPR's lower fine tier: up to €10 million or 2% of worldwide annual turnover, whichever is higher (Art. 83(4)). See GDPR fines for how fines are calculated.

UK notes

The UK GDPR has the same Article 35. The ICO's list of processing that needs a DPIA explicitly includes innovative technology, including AI, when combined with another criterion, and the ICO recommends doing a DPIA whenever in doubt. The ICO has said its DPIA guidance is under review following the Data (Use and Access) Act 2025, so check its website for the current version.

This is general information, not legal advice.

Why AI plus health or client data usually triggers one

Take the criteria above and apply them to a practice or law firm adopting an AI tool. Health or client data is sensitive or highly personal. AI counts as innovative technology; the ICO names it explicitly. Patients and clients are often vulnerable or in a position of dependence. That is two or three criteria before you even consider scale. In most professional settings, the honest answer is: do the DPIA.

A short DPIA template

Overview: project name, owner, date, DPO consulted (yes/no).
Processing description: data categories, people affected, sources, recipients, processors and subprocessors, storage location, retention.
Purpose and legal basis: Art. 6 basis, plus an Art. 9 exception for special category data.
Necessity and proportionality: why this data, why this tool, what less intrusive options were considered.
Risks: for each risk, likelihood and severity (low, medium, high).
Measures: per risk, the control and the residual risk.
Consultation: views of staff, patients or clients where appropriate.
Outcome and sign-off: accepted, changed or prior consultation needed. Review date.

What a DPIA does not protect

A DPIA is about risk to identifiable people. It stops at the same line as GDPR itself: Recital 26 says data protection does not apply to anonymous information. If your provider's terms let it create anonymised or "de-identified" data from what you upload, that reuse sits outside your DPIA and outside GDPR. The anonymised records can then be pooled, licensed and sold lawfully. We show the mechanism on the data trail, with sources on legal to sell.

Two more gaps:

A DPIA documents risk; it does not change the provider's contract. Many DPIAs record "provider may use data for service improvement" as an accepted risk.
Pseudonymised is not anonymous. A DPIA that treats pseudonymised data as low risk may be wrong. See pseudonymisation vs anonymisation.

What this means when you choose an AI tool

When you write the DPIA for an AI tool, the vendor's answers decide most of your risk section. Ask:

Is the provider your processor under a data processing agreement, acting only on your instructions?
Does it take a licence to reuse, analyse or anonymise your content?
Does it train on your content, or let the model providers behind it do so?
What is retained, for how long, and where is it processed?
Will it help with your DPIA, as a processor must under Art. 28(3)(f)?

Wysor makes these answers short. We act only as your processor under Art. 28 GDPR, take no licence to reuse your content, and never train on it or sell it, anonymised or not. Those commitments are in the contract and bind anyone who could ever own Wysor. Data is encrypted in transit and at rest, hosted in the EU, and every connected AI model provider runs with zero data retention: processed, then deleted. You get GPT, Claude, Gemini and more in one workspace.

FAQ

What does DPIA stand for? DPIA stands for data protection impact assessment. It is the risk assessment required by Article 35 GDPR (and the UK GDPR) before processing that is likely to result in a high risk to people.

Is a DPIA mandatory? Only where processing is likely to be high risk. It is always required in the three cases in Art. 35(3), for processing on your authority's list, and in most cases where two or more of the EDPB's nine criteria are met.

Who is responsible for the DPIA? The controller, meaning the organisation deciding why and how the data is used. Processors, such as software providers, must help, but cannot carry the responsibility for you.

Do I need a DPIA to use ChatGPT or another AI tool at work? If staff will enter health data, client files or other sensitive personal data, very likely yes. For purely non-personal tasks, usually not, but record that assessment.