GDPR DPIA (Article 35): When It's Required and a Template

When a DPIA Is Required

• Processing likely to result in high risk (Art 35(1))
• Especially the Art 35(3) examples and national DPIA blacklists
• New AI features, biometric access, large-scale tracking, employee monitoring at scale

DPIA Template Sections

1. Description of processing (nature, scope, context, purposes)
2. Necessity and proportionality assessment
3. Risks to data subjects (likelihood × severity)
4. Measures to address risks (Art 32 TOMs, PbD defaults)
5. Residual risk and go/no-go
6. DPO advice (where appointed) and stakeholder consultation
7. Review date / change triggers

How CyberSilo Helps

• CSA DPIA workflow with owners and review dates
• Links RoPA rows to DPIA IDs for accountability

Frequently Asked Questions

Who must do a DPIA?

The controller. The DPO advises where appointed; processors assist with information.

What if residual risk stays high?

Article 36 may require prior consultation with the supervisory authority before processing.

Is a DPIA a one-time document?

No. Revisit when the processing changes materially or risks shift.

Related GDPR Resources

GDPR hub · Privacy by design · GDPR & AI Act · CSA