GDPR DPIA (Article 35): When It's Required and a Template

A Data Protection Impact Assessment (DPIA) under Article 35 is required where processing is likely to result in a high risk to the rights and freedoms of natural persons. Article 36 covers prior consultation when residual risk remains high.

Related: GDPR hub · Article 25 · DPO.

Triggers (examples): systematic extensive evaluation/profiling with significant effects; large-scale special-category processing; systematic monitoring of publicly accessible areas. Check your supervisory authority’s DPIA list.

When a DPIA Is Required

Processing likely to result in high risk (Art 35(1))
Especially the Art 35(3) examples and national DPIA blacklists
New AI features, biometric access, large-scale tracking, employee monitoring at scale

DPIA Template Sections

Description of processing (nature, scope, context, purposes)
Necessity and proportionality assessment
Risks to data subjects (likelihood × severity)
Measures to address risks (Art 32 TOMs, PbD defaults)
Residual risk and go/no-go
DPO advice (where appointed) and stakeholder consultation
Review date / change triggers

How CyberSilo Helps

CSA DPIA workflow with owners and review dates
Links RoPA rows to DPIA IDs for accountability

Run DPIAs Before High-Risk Go-Lives

Gate AI, biometrics, and large-scale monitoring behind a completed Article 35 assessment.

Talk to CyberSilo GDPR Automation

Frequently Asked Questions

Who must do a DPIA?

The controller. The DPO advises where appointed; processors assist with information.

What if residual risk stays high?

Article 36 may require prior consultation with the supervisory authority before processing.

Is a DPIA a one-time document?

No. Revisit when the processing changes materially or risks shift.

GDPR hub · Privacy by design · GDPR & AI Act · CSA

GDPR DPIA (Article 35): When It's Required and a Template

When a DPIA Is Required

DPIA Template Sections