Glossary
What is a DPIA (data protection impact assessment)?
A DPIA assesses processing likely to result in a high risk before it starts. See when GDPR Article 35(3) makes one mandatory and how DOCNUS flags it.
By Nexlithic AILast updated
A DPIA, or data protection impact assessment, is an assessment a controller must carry out before starting processing that is likely to result in a high risk to people's rights and freedoms. It is required by Article 35 of the UK GDPR and EU GDPR.
What Article 35 requires
Article 35 says that where a type of processing is "likely to result in a high risk", the controller must assess the impact of the planned processing on the protection of personal data before it begins. The key word is before. A DPIA is a planning tool, not something to write after a project has gone live.
The general test is risk-based, so you need to judge each new or changed processing activity on its own facts.
When a DPIA is mandatory
Article 35(3) lists three cases where a DPIA is always required:
| Case | What it means in practice |
|---|---|
| Systematic and extensive automated evaluation, including profiling, with legal or similarly significant effects | Automated decisions about people that affect them in a real way |
| Large-scale processing of special category data or criminal offence data | For example, large volumes of health records or conviction data |
| Large-scale systematic monitoring of publicly accessible areas | For example, monitoring a public space at scale |
Outside these cases, you still need a DPIA where the processing is likely to result in a high risk. The three are a floor, not a complete list.
How it connects to other obligations
- Special category and criminal offence data. These are the data types named in the second mandatory case. See special category data and Article 9.
- Records of processing. Your record of processing activities shows what you process and why, which is a useful starting point for deciding which activities need a DPIA. See what is a RoPA.
- Jurisdiction. Article 35 appears in both the UK GDPR and the EU GDPR. See UK GDPR and EU GDPR.
How DOCNUS relates to DPIAs
DOCNUS does not write or manage DPIAs. Its privacy assessment, on Professional and Enterprise plans, can surface a DPIA as an obligation to consider, citing Article 35(3), alongside the special category and criminal offence data it found and an estimate of the number of data subjects in the document.
That is useful evidence when you are deciding whether a DPIA is needed. It shows where sensitive data sits, on which page, and how much of it there is. It is not the decision itself. Whether processing is "large scale" or "likely to result in a high risk" depends on your purposes and context, which a document scan cannot see.
The assessment is automated and is not legal advice. Review its findings, and make the DPIA call yourself or with your data protection officer.
Related
- Special category dataSpecial category data is the sensitive personal data in GDPR Article 9, such as health or biometric data. See the list, Article 10 and why it is high risk.
- What is a RoPA?A RoPA is the record of processing activities GDPR Article 30 requires controllers to keep. Learn what it is and the limits of the under-250-employee exemption.
- UK GDPRUK GDPR explained: personal data, special category and criminal offence data, the 2026 DUAA changes, and the articles DOCNUS cites when it assesses documents.
- Privacy assessmentDOCNUS scans PDFs and Word files for 50 kinds of personal data, then checks each document against 7 privacy laws and cites the articles behind every verdict.
Try DOCNUS on your own documents
Start on the free plan. No credit card required.