DPIA (data protection impact assessment)

What is a DPIA?

A DPIA is an assessment you carry out before you start processing personal data in a new way. You map the privacy risks to people and choose measures to reduce them.

DPIA stands for data protection impact assessment. In the Dutch legal text it is called a gegevensbeschermingseffectbeoordeling. The obligation is set out in Article 35 of the GDPR.

What goes into a DPIA?

You may choose a method yourself. But it must contain at least four things:

1. a description of the processing and its purpose;
2. why the processing is necessary, and whether it can also be done with less data;
3. the risks to the people whose data you use;
4. the measures you take, such as pseudonymisation, less access or encryption.

Start early, while you are still designing the processing. Does a high risk remain after your measures? Then you first consult the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) before you begin.

When is a DPIA mandatory?

A DPIA is mandatory if a processing activity is likely to pose a high risk to people. You decide that yourself, with three tools:

• the cases that the GDPR mentions, such as processing health data on a large scale;
• the AP's list, which includes monitoring employees, camera surveillance and profiling;
• nine criteria from the European supervisory authorities. Does your processing meet two or more? Then, as a rule of thumb, a DPIA is needed.

If you do not carry out a DPIA, you must be able to explain why not.

Example in an SME

Do you want to use AI with data about customers or employees? Read how I approach AI in your business, with business accounts and a data processing agreement.

Frequently asked questions

This is an explanation in plain language, not legal advice.

Sources: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): Data protection impact assessment (DPIA) (in Dutch) and Decision on the list of processing operations for which a DPIA is mandatory (Besluit lijst verwerkingen waarvoor een DPIA verplicht is, in Dutch). Consulted on 7 October 2026.