Glossary · Glossary · GDPR compliance
Data protection impact assessment (DPIA)
Anonimatum Team
In short
A DPIA is the assessment a controller must carry out before processing that is likely to result in a high risk to people's rights and freedoms: describe the processing, test its necessity, assess the risks and set out measures to reduce them.
The data protection impact assessment is set out in Article 35 of the GDPR, retained in the UK GDPR. It is not required for every processing activity, only for those that, by their nature, scope, context or purposes, could seriously affect people: large-scale CCTV, automated profiling, large health datasets or new technologies such as AI.
It is done before processing starts, documented and reviewed when things change. Done well, it is a design tool: it forces you to ask whether you need all the data and whether it could be anonymised or pseudonymised.
When a DPIA is mandatory
Article 35(1) requires a DPIA where processing is likely to result in a high risk. Article 35(3) names three cases where one is always needed:
- Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based.
- Large-scale processing of special category data (Article 9) or criminal offence data (Article 10).
- Systematic monitoring of a publicly accessible area on a large scale.
Beyond those, the Article 29 Working Party guidelines (WP248 rev.01), endorsed by the European Data Protection Board, set out nine risk criteria — evaluation or scoring, automated decisions, systematic monitoring, sensitive data, large scale, matching datasets, vulnerable people, innovative technology and processing that prevents people exercising rights — and say that, as a rule of thumb, meeting two or more means a DPIA is needed.
The ICO list and the UK position
Under Article 35(4), supervisory authorities publish lists of processing that always requires a DPIA. The ICO's list of processing “likely to result in high risk” covers innovative technology, denial of service, large-scale profiling, biometric data, genetic data, data matching, invisible processing, tracking, targeting children or other vulnerable people, and risk of physical harm. The ICO also considers it best practice to carry out a DPIA for other major projects involving personal data, even where high risk is not obvious.
The ICO notes that its DPIA guidance is under review following the Data (Use and Access) Act 2025, so check the current version before relying on details. In EU member states, each national authority publishes its own list.
What a DPIA must contain
| Element | In practice |
|---|---|
| Systematic description of the processing and its purposes | Data flows, systems, processors, retention periods |
| Necessity and proportionality | Why this data and no less; lawful basis |
| Assessment of risks to individuals | Likelihood and severity of unauthorised access, re-identification, discrimination |
| Measures to address the risks | Minimisation, pseudonymisation, anonymisation, encryption, access control, training |
You must seek the advice of your data protection officer (Article 35(2)). If high risk remains after mitigation, you must consult the supervisory authority — the ICO in the UK — before processing (Article 36). Failing to carry out a required DPIA is itself an infringement.
Anonymisation and pseudonymisation as mitigation
Few measures cut risk as much as no longer processing identifiable data. If an analysis can run on truly anonymous data, that data falls outside the GDPR (recital 26). But the act of anonymisation is itself processing of personal data and belongs in the assessment, including the risk of re-identification.
Where records must stay linkable, pseudonymisation is the classic safeguard, named in Articles 25 and 32. The data remains personal, so the DPIA should explain who holds the key and how it is protected. Our post on running a DPIA for an anonymisation project works through an example.
Where Anonimatum fits
Anonimatum applies these measures to documents: irreversible redaction, or pseudonymisation with consistent replacements and encrypted saved maps. For the DPIA of the tool itself, relevant facts are that its AI runs on servers in the European Union without sending text to external language-model APIs, and that Politeia Soft holds Spain's ENS security certification (category MEDIUM) covering Anonimatum. See our security page.
Frequently asked questions
Who carries out the DPIA?
The controller. Processors or consultants can help, but responsibility stays with the controller, who must seek the DPO's advice.
Does it need repeating?
It should be reviewed when the risk changes, for example new data sources, purposes or technologies (Article 35(11)).
Does anonymising data avoid a DPIA?
It can for later use of genuinely anonymous data, but the anonymisation process handles personal data and should be assessed.
Do we have to publish our DPIA?
There is no legal duty to publish it, although publishing a summary can help build trust with the people affected.
Turn DPIA measures into practice
See the plans and start anonymising or pseudonymising documents with AI hosted in the EU and a human review step.