DPIA — Data protection impact assessment
Article 35(1), first sentence, of Regulation (EU) 2016/679:
Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data..
Assessment of the impact of the envisaged processing operations on the protection of personal data, which the controller carries out prior to the processing where it is likely to result in a high risk to the rights and freedoms of natural persons.
It is the assessment made by whoever decides what personal data are processed for, before starting to process them.
Which obligations it carries
A legal obligation of the controller, applicable from 25 May 2018, and conditional: it arises where the processing is likely to result in a high risk to the rights and freedoms of natural persons. It is not triggered by a list: Article 35(3) sets out three cases “in particular” — a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the person; processing on a large scale of special categories of data or of data relating to criminal convictions and offences; and a systematic monitoring of a publicly accessible area on a large scale — but the criterion is that of paragraph 1. The supervisory authority also publishes its own list of the kinds of processing operations requiring one (Article 35(4)) and may publish the list of those that do not (Article 35(5)). The FRIA of Article 27 of Regulation (EU) 2024/1689, by contrast, is an obligation of the deployer and applicable from 2 December 2027.
What it is not
It is not the FRIA: the fundamental rights impact assessment of Article 27 of Regulation (EU) 2024/1689 is a structurally independent instrument, with a different obliged party, object and trigger. The fact that both may apply to one and the same system does not make them one instrument. It is not triggered by using AI: it is triggered by the likelihood of a high risk to rights and freedoms, with or without AI involved. It is not a formality for the data protection officer: the controller seeks the advice of the DPO where designated (Article 35(2)), but the obligation is the controller’s. And it is not always owed: Article 35(10) excepts one specific case, where the processing has its legal basis in Article 6(1), points (c) or (e), that basis lies in Union or Member State law, that law regulates the specific operation, and a data protection impact assessment has already been carried out as part of the general impact assessment when that legal basis was adopted.
The nuance almost nobody captures
Article 35(1) allows a single assessment to address a set of similar processing operations that present similar high risks. It is the part that saves the most work and that almost nobody uses. The four minimum contents of Article 35(7) are demanding on one specific point: point (d) does not ask only for measures, it asks for measures and the mechanisms “to demonstrate compliance with this Regulation”. And two elements separate it from the FRIA more than any definition. The first: Article 35(9) requires seeking, “where appropriate”, the views of data subjects or their representatives, without prejudice to the protection of commercial or public interests or the security of processing operations. The FRIA contains no equivalent element: its six contents describe those affected, they do not consult them. The second: Article 35(11) requires a review to assess whether processing is performed in accordance with the assessment, at least when there is a change of the risk. The FRIA is anchored to first use and allows reliance on previous assessments or the provider’s. One watches change; the other, the première.