# Fonte: WP248 rev. 01 - Guidelines on Data Protection Impact Assessment (DPIA)

**ID fonte**: `wp248-rev01-edpb`
**SHA256**: `4de1ee2df6bbe9517847b45ba8b0657e7de4c1bd796f107d940df255ca6ded67`
**URL pagina**: https://ec.europa.eu/newsroom/article29/items/611236
**URL download**: https://ec.europa.eu/newsroom/just/document.cfm?doc_id=47711
**Data consultazione**: 2026-05-10
**Licenza**: documento UE (WP29/EDPB), liberamente riproducibile per finalita' non commerciali.
**Adottato**: 4 aprile 2017, ultima revisione 4 ottobre 2017 (rev. 01)
**Endorsato dall'EDPB**: si

Trascrizione fedele delle sezioni rilevanti per la skill, estratte dal PDF verificato tramite SHA256.
Il documento e' di 22 pagine (23 contando la copertina). I numeri di pagina si riferiscono alla
numerazione interna del documento (pag. 1 = prima pagina del corpo, dopo copertina e TOC).

---

## Sezione I - Introduction (pag. 4 interna)

A DPIA is a process designed to describe the processing, assess its necessity and
proportionality and help manage the risks to the rights and freedoms of natural persons
resulting from the processing of personal data by assessing them and determining the
measures to address them. DPIAs are important tools for accountability, as they help
controllers not only to comply with requirements of the GDPR, but also to demonstrate that
appropriate measures have been taken to ensure compliance with the Regulation (see also
article 24). In other words, a DPIA is a process for building and demonstrating compliance.

Under the GDPR, non-compliance with DPIA requirements can lead to fines imposed by the
competent supervisory authority. Failure to carry out a DPIA when the processing is subject
to a DPIA (Article 35(1) and (3)-(4)), carrying out a DPIA in an incorrect way (Article 35(2)
and (7) to (9)), or failing to consult the competent supervisory authority where required
(Article 36(3)(e)), can result in an administrative fine of up to 10M EUR, or in the case of an
undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year,
whichever is higher.

---

## Sezione III.B.a - I 9 criteri per trattamenti "likely to result in a high risk" (pag. 9-11 interna)

In order to provide a more concrete set of processing operations that require a DPIA due to
their inherent high risk, taking into account the particular elements of Articles 35(1) and
35(3)(a) to (c), the list to be adopted at the national level under article 35(4) and recitals 71,
75 and 91, and other GDPR references to "likely to result in a high risk" processing
operations, the following nine criteria should be considered.

**1. Evaluation or scoring**, including profiling and predicting, especially from "aspects
concerning the data subject's performance at work, economic situation, health, personal
preferences or interests, reliability or behavior, location or movements" (recitals 71 and 91).
Examples of this could include a financial institution that screens its customers against a
credit reference database or against an anti-money laundering and counter-terrorist financing
(AML/CTF) or fraud database, or a biotechnology company offering genetic tests directly to
consumers in order to assess and predict the disease/health risks, or a company building
behavioural or marketing profiles based on usage or navigation on its website.

**2. Automated-decision making with legal or similar significant effect**: processing that
aims at taking decisions on data subjects producing "legal effects concerning the natural
person" or which "similarly significantly affects the natural person" (Article 35(3)(a)). For
example, the processing may lead to the exclusion or discrimination against individuals.
Processing with little or no effect on individuals does not match this specific criterion.

**3. Systematic monitoring**: processing used to observe, monitor or control data subjects,
including data collected through networks or "a systematic monitoring of a publicly accessible
area" (Article 35(3)(c)). This type of monitoring is a criterion because the personal data may
be collected in circumstances where data subjects may not be aware of who is collecting their
data and how they will be used. Additionally, it may be impossible for individuals to avoid
being subject to such processing in public (or publicly accessible) space(s).

**4. Sensitive data or data of a highly personal nature**: this includes special categories of
personal data as defined in Article 9 (for example information about individuals' political
opinions), as well as personal data relating to criminal convictions or offences as defined in
Article 10. An example would be a general hospital keeping patients' medical records or a
private investigator keeping offenders' details. Beyond these provisions of the GDPR, some
categories of data can be considered as increasing the possible risk to the rights and freedoms
of individuals. These personal data are considered as sensitive (as this term is commonly
understood) because they are linked to household and private activities (such as electronic
communications whose confidentiality should be protected), or because they impact the
exercise of a fundamental right (such as location data whose collection questions the freedom
of movement) or because their violation clearly involves serious impacts in the data subject's
daily life (such as financial data that might be used for payment fraud). This criterion may also
include data such as personal documents, emails, diaries, notes from e-readers equipped with
note-taking features, and very personal information contained in life-logging applications.

**5. Data processed on a large scale**: the GDPR does not define what constitutes
large-scale, though recital 91 provides some guidance. In any event, the WP29 recommends
that the following factors, in particular, be considered when determining whether the
processing is carried out on a large scale:
a. the number of data subjects concerned, either as a specific number or as a proportion of
the relevant population;
b. the volume of data and/or the range of different data items being processed;
c. the duration, or permanence, of the data processing activity;
d. the geographical extent of the processing activity.

**6. Matching or combining datasets**, for example originating from two or more data
processing operations performed for different purposes and/or by different data controllers in
a way that would exceed the reasonable expectations of the data subject.

**7. Data concerning vulnerable data subjects** (recital 75): the processing of this type of
data is a criterion because of the increased power imbalance between the data subjects and
the data controller, meaning the individuals may be unable to easily consent to, or oppose,
the processing of their data, or exercise their rights. Vulnerable data subjects may include
children (they can be considered as not able to knowingly and thoughtfully oppose or consent
to the processing of their data), employees, more vulnerable segments of the population
requiring special protection (mentally ill persons, asylum seekers, or the elderly, patients,
etc.), and in any case where an imbalance in the relationship between the position of the data
subject and the controller can be identified.

**8. Innovative use or applying new technological or organisational solutions**, like
combining use of finger print and face recognition for improved physical access control, etc.
The GDPR makes it clear (Article 35(1) and recitals 89 and 91) that the use of a new
technology, defined in "accordance with the achieved state of technological knowledge"
(recital 91), can trigger the need to carry out a DPIA. This is because the use of such
technology can involve novel forms of data collection and usage, possibly with a high risk to
individuals' rights and freedoms. Indeed, the personal and social consequences of the
deployment of a new technology may be unknown. A DPIA will help the data controller to
understand and to treat such risks. For example, certain "Internet of Things" applications
could have a significant impact on individuals' daily lives and privacy; and therefore require a
DPIA.

**9. When the processing in itself "prevents data subjects from exercising a right or using
a service or a contract"** (Article 22 and recital 91). This includes processing operations
that aims at allowing, modifying or refusing data subjects' access to a service or entry into a
contract. An example of this is where a bank screens its customers against a credit reference
database in order to decide whether to offer them a loan.

---

## Soglia di applicazione (pag. 11 interna)

In most cases, a data controller can consider that a processing meeting two criteria would
require a DPIA to be carried out. In general, the WP29 considers that the more criteria are
met by the processing, the more likely it is to present a high risk to the rights and freedoms
of data subjects, and therefore to require a DPIA, regardless of the measures which the
controller envisages to adopt. However, in some cases, a data controller can consider that
a processing meeting only one of these criteria requires a DPIA.

---

## Sezione III.D.c - Contenuto minimo della DPIA (pag. 15-16 interna)

The GDPR sets out the minimum features of a DPIA (Article 35(7), and recitals 84 and 90):
- "a description of the envisaged processing operations and the purposes of the processing";
- "an assessment of the necessity and proportionality of the processing";
- "an assessment of the risks to the rights and freedoms of data subjects";
- "the measures envisaged to:
  - 'address the risks';
  - 'demonstrate compliance with this Regulation'".

---

## Sezione III.E - Consultazione autorita' di controllo (pag. 18-19 interna)

[...] it is the responsibility of the data controller to assess the risks to the rights and freedoms
of data subjects and to identify the measures envisaged to reduce those risks to an acceptable
level and to demonstrate compliance with the GDPR (Article 35(7)). [...] In the laptop example
above, if the risks have been considered as sufficiently reduced by the data controller and
following the reading of Article 36(1) and recitals 84 and 94, the processing can proceed
without consultation with the supervisory authority. It is in cases where the identified risks
cannot be sufficiently addressed by the data controller (i.e. the residual risks remains high)
that the data controller must consult the supervisory authority.