A DPIA, or data protection impact assessment, is a written analysis that an organisation must complete before it starts processing personal data in a way "likely to result in a high risk to the rights and freedoms of natural persons", in the words of Article 35 of the EU General Data Protection Regulation (GDPR). It describes the processing, tests its necessity, identifies what could go wrong for the people concerned and records measures to reduce those risks. The instrument exists because the GDPR replaced a system of advance notification to regulators with one of self-assessed accountability. Instead of asking permission, the controller - the company that decides why and how data is processed - has to show its homework.

What a DPIA contains

Article 35(7) sets four minimum elements: a systematic description of the processing and its purposes, including any legitimate interest relied on; an assessment of necessity and proportionality; an assessment of the risks to individuals; and the safeguards, security measures and mechanisms envisaged to address them.

The controller carries the obligation, although processors must assist. Where a data protection officer (DPO) has been appointed, Article 35(2) requires the controller to seek that person's advice, and Article 39(1)(c) makes monitoring DPIAs one of the DPO's tasks. Article 35(9) asks the controller to seek the views of data subjects or their representatives "where appropriate". Article 35(11) requires a review at least when the risk changes.

The assessment is a gate, not a formality. If it shows that high residual risk remains after mitigation, Article 36 requires prior consultation with the supervisory authority before processing begins. The authority then has eight weeks to give written advice, extendable by six weeks for complex cases. Failure to carry out a required DPIA, or to consult when necessary, falls under Article 83(4)(a), which allows fines of up to 10 million euros or 2% of worldwide annual turnover, whichever is higher.

No format is prescribed. Risk is commonly scored as likelihood multiplied by severity on qualitative scales.

When one is required

Article 35(3) names three situations that always require a DPIA: systematic and extensive evaluation of personal aspects based on automated processing, including profiling, that produces legal or similarly significant effects; large-scale processing of special categories of data, such as health or biometric data, or of criminal records; and systematic monitoring of a publicly accessible area on a large scale.

Outside those three, the controller must judge. The Article 29 Working Party (WP29), the body of EU regulators that preceded the European Data Protection Board (EDPB), set out nine criteria in guidelines numbered WP248: evaluation or scoring; automated decisions with legal or similar effects; systematic monitoring; sensitive or highly personal data; large-scale processing; matching or combining datasets; data concerning vulnerable people such as children or employees; innovative technology; and processing that prevents people from exercising a right or using a service. The final text says processing meeting two criteria will in most cases require a DPIA, while allowing that one criterion can suffice.

Each national supervisory authority must also publish a list of processing that requires a DPIA under Article 35(4), and may publish a list of exempt processing under Article 35(5). The list of the United Kingdom's Information Commissioner's Office (ICO) shows how directly advertising is caught: its "tracking" heading cites "online advertising" and "web and cross-device tracking", and its "invisible processing" heading names "list brokering" and "online tracking by third parties".

Origin and evolution

The idea predates the GDPR. The 1995 Data Protection Directive required "prior checking" by regulators of risky processing and notification of most other processing. In 2011 WP29 endorsed a privacy impact assessment framework for radio-frequency identification (RFID) tags.

The Commission proposed the GDPR on January 25, 2012. The regulation was adopted on April 27, 2016 and has applied since May 25, 2018, when notification duties disappeared and Article 35 took their place. WP29 published draft DPIA guidelines on April 4, 2017 and adopted the revised version on October 4, 2017; the EDPB endorsed them on its first day, May 25, 2018. In September 2018 the board issued 22 opinions on national draft lists, asking some authorities to add operations and others to remove items that did not present high risk.

Other jurisdictions copied the mechanism. Brazil's General Data Protection Law (LGPD) defines a relatorio de impacto a protecao de dados pessoais (RIPD) in Article 5, XVII, and lets the National Data Protection Authority (ANPD) demand one under Article 38. ANPD guidance borrows high-risk criteria from Resolution 2/2022, pairing one general criterion such as large scale with one specific one such as children's data. The RIPD featured on ANPD's 2025-2026 regulatory agenda, adopted by Resolution 23 of December 9, 2024; no dedicated regulation had been published as of November 2026. According to compliance software vendor GlobalSuite Solutions, ANPD's August 2026 agenda review put the rule at the end of its impact analysis, with public consultation next. In the United States, Virginia has required "data protection assessments" for targeted advertising and profiling since January 1, 2023. California's risk-assessment rules took effect on January 1, 2026, covering the sale or sharing of personal information, with first submissions to the state's privacy agency due by April 1, 2028.

Why it matters to advertisers

Programmatic advertising tends to tick several WP29 boxes at once: large scale, combined datasets, profiling, location data and processing invisible to the person concerned. The ICO's update report into adtech and real-time bidding, dated June 20, 2019, concluded that organisations in the RTB ecosystem "are therefore legally required to perform DPIAs", and that "many organisations within the RTB ecosystem have not undertaken any such assessments".

Ireland's Data Protection Commission included an Article 35(1) infringement in its 405 million euro Instagram decision of September 2, 2022, over children's accounts. When France's CNIL fined retargeting firm Criteo 40 million euros in June 2023, it found that the company's agreements with partner websites left impact assessments unallocated; the Conseil d'Etat upheld the fine on March 4, 2026.

Spain's AEPD fined airport operator AENA 1.8 million euros over facial recognition at eight airports, finding that its assessments lacked a systematic description and a proportionality test against less intrusive options, even though AENA had twice consulted the regulator in 2020. In March 2026 it fined FC Barcelona 500,000 euros solely under Article 35. Its DPIA for a biometric membership census omitted facial biometric data from its inventory and rated 14 of 17 risk categories as low. A DPIA, in other words, can exist and still fail.

Artificial intelligence widens the field. The AEPD's February 2026 guide on agentic systems said most deployments involving special category data or large-scale profiling would likely require a DPIA. Published assessments can also be leverage: a Microsoft 365 Copilot DPIA for Dutch education cooperative SURF found four high risks in December 2024, two of them cut to medium in September 2025 after talks with Microsoft.

Limitations and disputes

The central weakness is that the controller marks its own paper. The GDPR contains no general duty to publish a DPIA, so outsiders rarely see one unless a regulator obtains it or a public body discloses it. A noyb survey of 510 data protection professionals, published in March 2026, ranked DPIAs second in workload behind records of processing, and 82% of respondents said controller risk assessments arrive at a predetermined outcome.

Fragmentation is a second complaint: national lists differ by design, so one campaign set-up can need an assessment in one member state and not another. The threshold itself is contested: data and technology lawyer Peter Craddock argued that the EDPB's 2026 template implies one criterion triggers a DPIA, where the 2017 guidelines speak of two.

What a DPIA is not

Privacy impact assessment (PIA). The older, broader term used in Canada, Australia and pre-GDPR British guidance. The labels are often used interchangeably, but only a DPIA meets Article 35.

Fundamental rights impact assessment (FRIA). Required by Article 27 of the EU AI Act from certain deployers of high-risk AI, such as public bodies and credit scorers, from December 2, 2027. It covers rights beyond privacy, and Article 27(4) says it complements a DPIA rather than replacing it.

Legitimate interest assessment (LIA). A three-part balancing test supporting a legal basis under Article 6(1)(f). It answers whether processing may happen at all; a DPIA asks how risky it is and what reduces the risk.

Transfer impact assessment (TIA). A review of a third country's laws before relying on standard contractual clauses, born of the 2020 Schrems II ruling.

Recent developments

The EDPB adopted its first DPIA template on March 10, 2026. It runs from an asset inventory covering APIs, segmentation models and demand-side platform (DSP) integrations to one of four conclusions: abandon, consult the authority, proceed, or proceed conditionally. Using it is not mandatory: the EDPB's explainer says controllers may use "the DPIA methodology of their choice". The cover calls version 1.0 "adopted", though its version history describes adoption "for public consultation". Consultation closed on June 9, 2026, and as of November 5, 2026 the board had published no revised or final version.

The Commission's Digital Omnibus proposal of November 19, 2025 would have moved list-making from national authorities to Brussels, with the Commission adopting EU-wide lists on the board's proposal. The Council's mandate, agreed by ambassadors on October 21, 2026, gives the board itself that task, with lists due within nine months of the rules applying. Parliament lags: its lead committees issued a draft report on June 22, 2026, but had not voted by the end of October 2026, and trilogue talks had not begun.

Timeline

  • October 24, 1995 - Data Protection Directive 95/46/EC introduces prior checking of risky processing
  • February 11, 2011 - WP29 endorses the RFID privacy impact assessment framework
  • January 25, 2012 - Commission proposes the GDPR
  • April 27, 2016 - GDPR adopted, including Articles 35 and 36
  • April 4, 2017 - WP29 publishes draft DPIA guidelines (WP248)
  • October 4, 2017 - WP29 adopts revised guidelines with nine criteria
  • May 25, 2018 - GDPR applies; EDPB endorses WP248
  • September 2018 - EDPB adopts 22 opinions on national DPIA lists
  • June 20, 2019 - ICO adtech report says RTB participants must perform DPIAs
  • September 2, 2022 - Irish DPC fines Instagram 405 million euros, including Article 35(1)
  • January 1, 2023 - Virginia data protection assessments take effect
  • December 9, 2024 - ANPD adopts 2025-2026 regulatory agenda covering the RIPD
  • December 2024 - SURF publishes Microsoft 365 Copilot DPIA with four high risks
  • July 2, 2025 - EDPB Helsinki Statement commits to common templates
  • September 11, 2025 - SURF lowers two Copilot risks to medium
  • November 2025 - AEPD sanctions AENA 1.8 million euros, partly over deficient DPIAs
  • November 19, 2025 - Digital Omnibus proposes EU-level DPIA lists
  • January 1, 2026 - California risk-assessment regulations take effect
  • February 2026 - AEPD publishes guide on agentic AI and data protection
  • March 4, 2026 - AEPD publishes 500,000 euro Article 35 fine on FC Barcelona
  • March 10, 2026 - EDPB adopts DPIA template version 1.0
  • April 14, 2026 - EDPB announces the template
  • June 9, 2026 - Template consultation closes
  • June 22, 2026 - Parliament ITRE-LIBE draft report on the Digital Omnibus
  • October 21, 2026 - Coreper agrees Council mandate giving the EDPB list-making powers
  • December 2, 2027 - AI Act Annex III duties, including FRIAs, apply
  • December 31, 2027 - California deadline for assessments of pre-existing processing
  • April 1, 2028 - First California risk-assessment submissions due

Summary

Who: Controllers carry out DPIAs, with advice from their data protection officer and help from processors. National supervisory authorities set lists and receive prior consultations; the EDPB issues guidance and templates. Brazil's ANPD and California's privacy agency run equivalent regimes.

What: A documented assessment of high-risk personal data processing that describes the operation, tests necessity and proportionality, evaluates risks to individuals and records mitigating measures.

When: Required under the GDPR since May 25, 2018, before high-risk processing begins and again when risks change. The EDPB template arrived in 2026, and EU-wide lists remain under negotiation as of November 2026.

Where: Across the European Economic Area and the UK under Article 35, with parallel duties in Brazil under the LGPD and in US states including Virginia and California.

Why: It replaced advance notification with accountability, forcing organisations running profiling, tracking, biometric or AI processing - much of modern advertising - to identify harm before it happens and to justify, in writing, why the processing should go ahead.