Published · Last updated
Summary: A data protection impact assessment (DPIA) is an ongoing process – not a form filled in once and archived. New purposes, new technology, more data, new integrations, supplier changes, new recipients or an incident should all trigger a fresh assessment. Build the DPIA into your project and change process, make it a genuine basis for decisions, and involve the DPO without letting them own the decision.
An organisation introduces a new system. Someone carries out an impact assessment. The document is approved, archived and forgotten. Three years later the system has new modules, new integrations, a new supplier, more users and a new use case. The DPIA is still the one from 2023.
This is a common problem. The impact assessment is treated as a one-off form instead of as a living basis for decisions.
What is the DPIA actually supposed to do?
An impact assessment under the GDPR is meant to help the organisation identify and manage the risks to data subjects before processing begins – particularly where the processing is likely to result in a high risk. It is about understanding what actually happens to the data, what consequences it may have for people, and which safeguards are needed.
But the risks change when the processing changes. That is why the assessment cannot be static.
Changes that should trigger a new assessment
There is no exact list that fits everyone, but in practice the following changes should always lead to the DPIA being reviewed:
- New purpose – the data is used for something other than what was originally assessed.
- New technology – for example AI, automated decision-making, profiling or new analytics functionality.
- More data – more categories of data, sensitive data, or data about new groups of people.
- Greater scale – more data subjects, more users or broader use across the organisation.
- New integration – the system is connected to other systems and the data flows in new ways.
- Supplier change – a new supplier, a new sub-processor, a new operating model or a new storage location.
- New recipient or transfer – data is shared with new parties or transferred to a third country.
- Incident or identified deficiency – something has happened that shows the earlier risk assessment did not hold.
Often it is not a single change that makes the difference, but the sum of many small steps taken over several years without anyone stopping to ask: does our assessment still hold?
Build the DPIA into the change process
The easiest way to avoid outdated assessments is to make the DPIA question a natural checkpoint in what you already do. The impact assessment should be brought up at:
- project start
- system procurement
- major change requests
- supplier changes
- product development
- introduction of AI functionality
- integration changes
The checkpoint does not need to be big. Often a single question in the change or project template is enough: Does the change affect how personal data is processed, and is there a current impact assessment that covers it? The answer determines whether a screening, an update or an entirely new DPIA is needed.
The DPIA should be a basis for decisions
A good impact assessment is not a document written for the supervisory authority. It is a basis for the organisation’s own decisions. It should be able to answer:
- What are we going to do, and why?
- Which data is processed, about whom, and for how long?
- What risks does this pose to the data subjects?
- How severe and how likely are the risks?
- Which safeguards are we putting in place?
- What risk remains after the measures?
- Is the residual risk acceptable – and who decides that?
- Do we need to consult the supervisory authority?
- When, and upon which changes, should the assessment be reviewed?
The Swedish Authority for Privacy Protection (IMY) describes the impact assessment as a multi-step process – from deciding whether a DPIA is needed, through describing the processing and assessing risks, to measures, documentation and follow-up. The last step is the one most often dropped.
The DPO should be involved – but should not own the decision
Under the GDPR, the controller must seek the advice of the data protection officer when carrying out an impact assessment. The DPO should advise, review the methodology and assess whether the safeguards are adequate. But the decision to carry out the processing – and to accept the residual risk – belongs to the business and to management.
If the DPO instead writes, approves and owns the DPIA, both independence and the business’s accountability disappear. The assessment then becomes a formality – not a basis for decisions.
How Kristensson i Skåne can help
We work with impact assessments as part of a functioning data protection programme – not as a stand-alone paper product. Depending on your needs, we can contribute with:
- screening of whether a DPIA is needed
- DPIA workshops with the business, IT and legal
- mapping of the processing and data flows
- legal and technical analysis
- risk assessment from the data subjects’ perspective
- proposed safeguards
- documentation that stands up to scrutiny
- linking the DPIA to the project, procurement and change process
- follow-up and updating of earlier DPIAs
An impact assessment that is still accurate is worth something. One sitting in the archive from 2023 is not.
Do you have impact assessments that need reviewing? Read more about our data protection and privacy services and GDPR support, or contact us for an informal conversation.
Sources: General Data Protection Regulation (GDPR), Article 35 on data protection impact assessments and Article 36 on prior consultation; the Swedish Authority for Privacy Protection (IMY), guidance on impact assessments.
This text is general information and does not constitute legal advice in an individual matter.