--- title: "Data protection impact assessment (DPIA)" description: "Data protection impact assessment under GDPR Article 35(1): the assessment a controller must make before processing likely to result in a high risk." canonical: "https://gencompl.ai/glossary/data-protection-impact-assessment-gdpr" language: "en-US" type: "Glossary term" published: "2026-10-14T18:23:56.894Z" modified: "2026-10-14T19:19:53.657Z" --- # Data protection impact assessment (DPIA) Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks. Also known as: DPIA, gegevensbeschermingseffectbeoordeling, GEB **What is a "data protection impact assessment" under the GDPR?** Defined in: [Normenkader IBP](https://gencompl.ai/regulations/normenkader-ibp) [Home](https://gencompl.ai/) › [Glossary](https://gencompl.ai/glossary) › Data protection impact assessment (DPIA) > Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks. ## Defined in / by - [GDPR (32016R0679)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Article 35(1) Last updated: 14 October 2026. ## Before the processing starts, not after Two words in Article 35(1) do most of the work: "high risk" decides whether an assessment is needed, and "prior" decides when. A DPIA written after a learning platform has gone live meets neither the letter nor the purpose of the provision. Article 35(3) names three cases that always require one: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; processing of special categories of data on a large scale; and systematic monitoring of a publicly accessible area on a large scale. Article 35(4) requires each supervisory authority to publish its own list of processing that needs a DPIA, and the [Autoriteit Persoonsgegevens](https://gencompl.ai/authorities/autoriteit-persoonsgegevens) has done so for the Netherlands. Article 35(7) sets the minimum content: a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to data subjects, and the measures to address them. Where the assessment shows a high risk the controller cannot mitigate, Article 36 requires prior consultation of the supervisory authority. Kennisnet's begrippenlijst for the Normenkader IBP uses the Dutch name, gegevensbeschermingseffectbeoordeling, alongside the English abbreviation. > **What we could not establish** > > This entry fixes the term as the GDPR words it. It does not decide whether a given processing at your school or organisation meets the Regulation; that is a question for your data protection officer or counsel. ## Questions and answers ### When must a DPIA be carried out under the GDPR? Before the processing starts, where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons. Article 35(3) of the GDPR lists three cases that always qualify, and Article 35(4) adds each supervisory authority's own list. ### Can one DPIA cover several processing operations under the GDPR? Yes. Article 35(1) of the GDPR allows a single assessment to address a set of similar processing operations that present similar high risks. ## Sources - [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) (EUR-Lex · 4 May 2016) - [Normenkader IBP: begrippenlijst](https://normenkaderibp.kennisnet.nl/begrippenlijst/) (Kennisnet) ## Related content ### Regulation - [Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)](https://gencompl.ai/regulations/normenkader-ibp): The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.