-
Article Summary: The Data Protection Impact Assessment (DPIA ) is a requirement under Article 35 of GDPR. It is mandatory whenever processing is likely to result in a high risk to the rights and freedoms of data subjects. The CNIL (National Commission for Information Technology and Civil Liberties) established nine criteria: if your processing activity meets at least two of them, a DPIA is required. In the event of non-compliance, the fine can reach up to €10 million or 2% of global annual turnover. Dipeeo handles your DPIA through a outsourced DPO and an intuitive platform.
AIPD stands for Data Protection Impact Assessment. It is an assessment conducted before initiating the processing of personal data to evaluate its impact on privacy. The CNIL (National Commission for Information Technology and Civil Liberties) defines CNIL (National Commission for Information Technology and Civil Liberties) as a tool that helps ensure data processing complies with GDPR respects the rights of data subjects. It is therefore a way to demonstrate that you have the risks under control.
Not all companies are required to conduct a data protection impact assessment (DPIA). The requirement applies when the processing is likely to result in a high risk. The CNIL (National Commission for Information Technology and Civil Liberties) laid out the guidelines with an official list and a framework of nine criteria.
“High risk” is determined by the nature and scope of the processing.Article 35 lists three cases in which the law presumes in advance that the risk is high:
This list is not exhaustive, which leaves room for some delicate interpretation.
The CNIL (National Commission for Information Technology and Civil Liberties) published a positive list of fourteen types of operations for which an analysis is required. For example.
If your project is included on this list, the matter is closed. This list is the result of Resolution No. 2018-327 of October 11, 2018. Correspondingly, a negative list was adopted by Resolution No. 2019-118 of September 12, 2019, following consultation with the European Data Protection Board.
An AIPD is also not required when the processing is carried out to comply with a legal obligation that is already governed by a regulation that has been reviewed.
There is a gray area between mandatory and optional processing. When the processing is not included on any list, the CNIL (National Commission for Information Technology and Civil Liberties) to the nine criteria set forth in the G29 guidelines, which have been adopted by the EDPB. As soon as at least two of these criteria are met, an analysis becomes mandatory. Here are the different situations:
Even if only one criterion is met, the CNIL (National Commission for Information Technology and Civil Liberties) conducting a data protection impact assessment (DPIA) as a precaution. This process helps ensure your compliance, regardless of the actual risk. When in doubt, the assessment protects you.
Article 35(7) of GDPR the minimum requirements for a compliant data protection impact assessment (DPIA). It consists of four key elements. Failing to address these elements results in an assessment that cannot be relied upon during an audit.
| Required field | Nature | Key question |
| Description of the treatment | Technical and operational | What are you doing, with what data, and for what purpose? |
| Necessity and proportionality | Legal | Is this treatment justified and appropriate? |
| Risk Analysis | Technical (safety) | What are the risks to people, and how serious are they? |
| Reduction measures | Technical and organizational | How can we reduce the risk to an acceptable level? |
This section should describe the data processing activities, the parties involved, data flows, data categories, recipients, Data retention periods Data retention any Data retention transfers. The more detailed the description, the more robust the analysis becomes.
Next comes a more legal assessment. Is the processing necessary for its Purpose Is the data collection proportionate? This section verifies the fundamental, non-negotiable principles: lawfulness, data minimization, limited retention period, information, and the rights of data subjects.
The third section, which focuses on technical aspects, examines data security risks: confidentiality, integrity, and availability. For each potential incident, you identify the threats and then rate the risk based on its severity and likelihood.
Finally, the AIPD outlines the measures being considered: encryption, access controls, pseudonymization, awareness-raising, and oversight of processors. The goal is to reduce each risk to an acceptable level and to demonstrate this.
A rigorous analysis consists of five steps.
You define the scope of the processing: purposes, media, and data flows. You identify the parties involved, including data controllers, processors recipients. An unclear context can skew the entire analysis.
You are evaluating the processing against the fundamental principles. Is the legal basis sound? Is the data limited to what is strictly necessary? Are the data subjects informed, and are their rights respected?
This is the technical core. You assess privacy risks related to data security and ensure they are properly addressed. Each risk is rated for severity and likelihood from the perspective of individuals. This rating helps you prioritize your actions.
For each risk, you must identify the appropriate technical and organizational measures. If the residual risk remains high despite these measures, you must consult with the CNIL (National Commission for Information Technology and Civil Liberties) proceeding with any deployment.
Finally, you formalize the approval of the analysis. The AIPD is not set in stone: it is developed before the processing begins and is then regularly reviewed throughout its lifecycle. Any significant changes warrant an update.
Good to know: The AIPD must be conducted before data processing begins. If carried out after the incident, it no longer serves its preventive purpose and does not remedy the breach in the eyes of the CNIL (National Commission for Information Technology and Civil Liberties).
Just reading the texts isn’t enough—you also have to make sense of them. Between the GDPR, the EDPB guidelines, and the CNIL (National Commission for Information Technology and Civil Liberties) lists, the sources are piling up. Here’s who says what and where the pitfalls lie.
Article 35 of the General Data Protection Regulation is the founding text of the AIPD. It establishes the obligation, sets forth the minimum requirements, and provides for prior consultation with the authority in cases of high residual risk.
The EDPS guidelines, which were adopted from the G29, define the concept of high risk and set out the nine criteria.
CNIL (National Commission for Information Technology and Civil Liberties) positive list CNIL (National Commission for Information Technology and Civil Liberties) a presumption of high risk, but should be interpreted with caution. A processing operation not included on the list may still be subject to AIPD under the nine criteria. Conversely, inclusion on the negative list does not exempt an organization from complying with the other principles of GDPR. The list serves as a guide; it does not replace a case-by-case analysis.
Dipeeo Tip: Don’t confuse the AIPD with other similar assessments. Under the AI Act, a high-risk AI system may require both an AIPD and a fundamental rights impact assessment.
The data controller remains legally obligated to ensure the compliance of its processing activities, but it does not act alone. When a Data Protection Officer (DPO) is appointed, the General Data Protection Regulation ( GDPR ) requires the data controller to seek the DPO’s advice and entrust the DPO with verifying compliance with the Data Protection Impact Assessment (DPIA). The DPO serves as the methodological lead for the analysis, without assuming final Accountability for it.
A DPIA is the data protection impact assessment required by Article 35 of GDPR. It becomes mandatory whenever processing is likely to result in a high risk:
A compliant analysis consists of four elements: a description of the processing, necessity and proportionality, a risk analysis, and mitigation measures. The CNIL (National Commission for Information Technology and Civil Liberties) method CNIL (National Commission for Information Technology and Civil Liberties) of five steps, which must be completed prior to deployment and reviewed on a regular basis.
Would you like to complete your AIPD with complete peace of mind? And ensure your compliance from start to finish?
Talk to an outsourced DPO expert outsourced by filling out the form on our website
No. It applies only to processing operations that are likely to pose a high risk to the rights and freedoms of data subjects. A processing operation is covered if it appears on the official list of the CNIL (National Commission for Information Technology and Civil Liberties) it meets at least two of the nine criteria set forth by the EDPB.
There is no legally prescribed timeframe. The duration depends on the complexity of the processing, the volume of data, and the availability of internal staff. A simple AIPD can be completed in a few days, while complex processing may take several weeks.
Not necessarily. There is no general requirement to publish or disclose such information. However, you must consult the CNIL (National Commission for Information Technology and Civil Liberties) the residual risk remains high despite the measures taken.
Legally speaking, yes: the data controller is free to choose their own method and may conduct the analysis in-house. In practice, however, this is a demanding task, and a poorly conducted data protection impact assessment (DPIA) can create a false sense of security and backfire on the company during an audit. It is therefore advisable to seek professional assistance.
The violation falls under Article 83(4) of GDPR. The fine may amount to up to 10 million euros or 2% of the total worldwide annual turnover of the preceding fiscal year, whichever is higher. Beyond the amount of the fine, the absence of a DPA constitutes an aggravating circumstance that increases the penalty for other violations, as demonstrated by several recent decisions by the CNIL (National Commission for Information Technology and Civil Liberties).
