DPIA: mandatory when processing creates high risk

A Data Protection Impact Assessment (DPIA) is a structured process to identify and minimise data protection risks before you start processing. It is not a voluntary best practice—GDPR Article 35 makes it compulsory whenever processing is likely to create high risk to individuals' rights and freedoms. Common triggers include systematic monitoring of people (e.g., CCTV in a shopping centre), large-scale processing of special categories of data (health, biometrics, political opinions), or using new technologies in novel ways (e.g., AI profiling for credit scoring). The key contrast: low-risk processing like a staff newsletter does not need a DPIA, but high-risk processing always does.

To spot a DPIA question quickly, look for keywords like 'systematic', 'large scale', 'sensitive data', or 'new technology' in the scenario. If the processing involves profiling, tracking location, or evaluating people (e.g., performance at work), that is a red flag for high risk. A useful elimination trick: if the question lists a DPIA as optional, it is almost certainly wrong when the facts show high risk. Another hint: the DPIA must be done before processing starts, not after a breach occurs—so a timeline trap might try to place it as a reactive measure.

Remember the trigger as 'HIGH'—H for health/biometric data, I for innovative technology, G for large-scale gathering, H for high-risk profiling. If any of these appear, the DPIA is mandatory, not a nice-to-have. To test yourself, ask: 'Would this processing make a reasonable person worried about their privacy?' If yes, a DPIA is required.