HumenhukCIPP/E Study Guide
IAPP Training, Module 10 - BoK IV.B

Module 10, Data protection impact assessment (DPIA, Articles 35 and 36)

Reviewed by Victor Humenhuk. Published . Reviewed .

A DPIA has two values: incorporate data protection into planning and demonstrate compliance to SAs. A PIA is broader and lighter and can run on any process; a DPIA is a legal requirement in some cases with specified contents, and the DPO advises on and monitors it (Article 39). A DPIA is required where processing is likely to result in a high risk - especially new technologies, large-scale profiling, large-scale special-category data, or large-scale monitoring of a public area. Under Article 36 you must consult the SA only when a high risk remains unmitigated.

A DPIA has two values: incorporate data protection into planning and demonstrate compliance to SAs. A PIA is broader/lighter and can run on any process; a DPIA is a legal requirement in some cases with specified contents. The DPO advises on and monitors the DPIA (Article 39).

  • When required - processing likely to result in a high risk, especially: new technologies; systematic and extensive evaluation/profiling with significant effects; large-scale special-category data; or large-scale systematic monitoring of a public area.
  • Contents - a description of the processing, its necessity and proportionality, the risks, and the measures to mitigate them.
  • Prior consultation (Article 36) - consult the SA when a high risk remains unmitigated; the SA advises and may block the processing.
Common trap

You do NOT always consult the SA after a DPIA. Prior consultation under Article 36 is only triggered when a high risk remains unmitigated.

Key terms - quick answers

What is “DPIA”?
Data protection impact assessment - a legal requirement in high-risk cases, with specified contents, used to plan in protection and demonstrate compliance.
What is “PIA”?
Privacy impact assessment - a broader, lighter assessment that can be run on any process; not the GDPR's legal requirement.
What is “Prior consultation”?
Article 36 duty to consult the supervisory authority when a high risk remains after mitigation; the SA may advise or block the processing.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.