DPIA screening

Statutory examples

If any of these applies, the DPIA is required directly under Art. 35(3) GDPR.

1. Is there a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based?

Examples: credit scoring, automated applicant screening, creditworthiness checks before contracting.

Yes No Unclear

Art. 35 Abs. 3 lit. a DSGVO

2. Are special categories of personal data (Art. 9) or data on criminal convictions and offences (Art. 10) processed on a large scale?

Health, religion, trade-union, biometric or genetic data, sexual orientation, political opinion. "Large scale" by number of data subjects, volume, duration and geographic reach.

Yes No Unclear

Art. 35 Abs. 3 lit. b DSGVO

3. Is there systematic monitoring of a publicly accessible area on a large scale?

Video surveillance of squares, stations, shopping centres; number-plate recognition.

Yes No Unclear

Art. 35 Abs. 3 lit. c DSGVO

DSK must-list

The German supervisory authorities have published a list under Art. 35(4) GDPR of operations for which a DPIA must be carried out.

4. Is the processing on the DSK must-list?

Among others: employee monitoring using movement or communication data, central fraud-prevention systems, large-scale location data, merging data sets from different sources, anonymising Art. 9 data, AI-driven processing that steers interaction with data subjects, telematics tariffs, whistleblowing systems holding sensitive data. The current list is published by the DSK.

Yes No Unclear

DSK Muss-Liste nach Art. 35 Abs. 4

Nine criteria (WP 248)

Where two or more criteria apply, a DPIA is required in most cases. With one criterion it should be considered and the decision documented.

5. Evaluation or scoring, including profiling and predicting?

Work performance, economic situation, health, preferences, reliability, behaviour, location.

Yes No Unclear

WP29 WP 248, Kriterium 1

6. Automated decision-making with legal or similarly significant effect?

Yes No Unclear

WP29 WP 248, Kriterium 2

7. Systematic monitoring?

Observing, monitoring or controlling data subjects, including via networks or in publicly accessible areas.

Yes No Unclear

WP29 WP 248, Kriterium 3

8. Sensitive data or data of a highly personal nature?

Art. 9 and Art. 10 data, but also financial data, location data, electronic communications, documents from private life.

Yes No Unclear

WP29 WP 248, Kriterium 4

9. Data processed on a large scale?

Yardsticks: number of data subjects, data volume, duration or permanence, geographic extent.

Yes No Unclear

WP29 WP 248, Kriterium 5

10. Matching or combining data sets?

From at least two operations with different purposes, in a way data subjects would not reasonably expect.

Yes No Unclear

WP29 WP 248, Kriterium 6

11. Data concerning vulnerable data subjects?

Employees, children, patients, asylum seekers, the elderly – wherever there is an imbalance of power.

Yes No Unclear

WP29 WP 248, Kriterium 7

12. Innovative use or applying new technological or organisational solutions?

For example AI systems, Internet of Things, combined fingerprint and face recognition.

Yes No Unclear

WP29 WP 248, Kriterium 8

13. Does the processing prevent data subjects from exercising a right or using a service or a contract?

For instance a credit check that decides whether a loan is granted.

Yes No Unclear

WP29 WP 248, Kriterium 9