GDPR data protection impact assessments: what Articles 35 and 36 require of a public body, and how to run them

The DPIA replaced the general notification duty of Directive 95/46/EC: Recital 89 says indiscriminate notification should give way to procedures focused on the operations likely to result in a high risk. The controller assesses the dangerous cases itself, keeps the record, and consults only where it cannot bring the risk down. For a public body the duty carries a mandatory DPO, a public-task legal basis with its own exemption, an invitation in Recital 92 to assess shared platforms once, and a fine regime whose reach into the public sector is a national decision.

What Article 35 requires

Article 35(1) is the trigger: where a type of processing, “in particular using new technologies,” and taking into account its nature, scope, context and purposes, “is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.” A single assessment may address a set of similar operations presenting similar high risks. Article 35(3) names three cases where one is required “in particular”:

• (a) a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the person;
• (b) processing on a large scale of Article 9(1) special categories of data, or of Article 10 data relating to criminal convictions and offences; or
• (c) a systematic monitoring of a publicly accessible area on a large scale.

Under 35(4) each supervisory authority must publish a list of operations that require a DPIA and under 35(5) may publish a list of those that do not; both go to the European Data Protection Board, and 35(6) routes cross-border lists through the consistency mechanism. The Board reviewed the draft national lists in Article 64 opinions in 2018, for example Opinion 9/2018 on France's list and Opinion 22/2018 on the United Kingdom's. 35(2) requires the DPO's advice, 35(8) takes approved codes of conduct into due account, 35(9) requires data subjects' views to be sought where appropriate, and 35(11) requires a review of whether processing follows the assessment “at least when there is a change of the risk represented by processing operations.”

One paragraph is written for public bodies. Under 35(10), where processing under Article 6(1)(c) or (e) rests on a Union or Member State law that regulates the specific operation, and a DPIA was carried out as part of a general impact assessment when that law was adopted, paragraphs 1 to 7 do not apply unless the Member State deems a further assessment necessary (Recital 93). WP248 rev.01 cautions that the adopted law may differ from the proposal and the technical detail is rarely known when it passes, so “it may still be necessary to carry out a specific DPIA prior to carrying out the actual processing activities.”

The minimum contents: Article 35(7)

The table pairs each required element with what Annex 2 of WP248 rev.01, the Working Party's criteria for an acceptable DPIA, expects under it, and with where it lives in AccessPoint.

Paragraph (b) asks for an argument, not a statement: why the operation is necessary and proportionate, including the less intrusive alternatives considered. Paragraph (d) reads with 35(11): the measures “envisaged” are promises, and an assessment whose measures were never implemented or revisited when the risk changed does not demonstrate compliance.

Screening: the nine criteria and the two-criteria rule

WP248 rev.01 was adopted on 4 April 2017 and last revised on 4 October 2017; the European Data Protection Board endorsed it in Endorsement 1/2018 on 25 May 2018, so it carries the Board's authority. It gives nine criteria for processing likely to result in a high risk:

1. Evaluation or scoring, including profiling and predicting.
2. Automated decision-making with legal or similar significant effect.
3. Systematic monitoring, including of a publicly accessible area.
4. Sensitive data or data of a highly personal nature, reaching beyond Articles 9 and 10 to location, financial and communications data.
5. Data processed on a large scale.
6. Matching or combining datasets beyond the data subject's reasonable expectations.
7. Data concerning vulnerable data subjects: children, employees, patients, asylum seekers, the elderly, or any power imbalance with the controller.
8. Innovative use or new technological or organisational solutions.
9. Processing that prevents data subjects from exercising a right or using a service or a contract.

The rule of thumb: “In most cases, a data controller can consider that a processing meeting two criteria would require a DPIA to be carried out,” the more criteria met the more likely a high risk, and in some cases one criterion is enough. For large scale, which the Regulation does not define, the Working Party recommends four factors: the number of data subjects, as a number or a proportion of the relevant population; the volume or range of data items; the duration or permanence of the processing; and its geographical extent. Recital 91 gives the floor: an individual physician's patient records are not large scale.

On timing the guidelines are firm. The DPIA is carried out “prior to the processing,” started as early as practicable in the design and updated through the project; it is “a continual process, not a one-time exercise.” For processing that pre-dates May 2018, a DPIA “could be required after a change of the risks,” and as good practice an assessment “should be continuously reviewed and regularly re-assessed.” The DPO's advice and the controller's decisions on it should be documented within the DPIA, as should any justification for not seeking data subjects' views.

Article 36: prior consultation and the eight-week clock

Article 36(1) requires consultation before processing “where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.” Recital 84 puts it operationally: where the controller cannot mitigate the risk “by appropriate measures in terms of available technology and costs of implementation.” The focus is residual risk: a high risk that mitigations brought down does not trigger consultation; a high risk that was accepted does.

Article 36(3) lists what must be provided: the respective responsibilities of the controller, joint controllers and processors; the purposes and means of the processing; the measures and safeguards protecting data subjects' rights; the DPO's contact details; the DPIA itself; and any other information the authority requests. The clock in Article 36(2) runs from receipt of the request:

• written advice within a period of up to eight weeks, and the authority may use any of its Article 58 powers;
• an extension of six weeks for the complexity of the processing;
• notice of any extension, with reasons, within one month of receipt; and
• suspension of the periods until requested information is obtained.

Fourteen weeks is therefore the planning figure for a complex case, before any suspension, and Recital 94 makes clear that silence within the period is without prejudice to the authority's powers, including prohibiting the processing. Two paragraphs are specific to the public sector: under 36(4) Member States consult the authority while preparing legislative or regulatory measures that relate to processing, and under 36(5) Member State law may require controllers to consult with, and obtain prior authorisation from, the authority for processing in the public interest, “including processing in relation to social protection and public health.” Check national law for that regime before assuming 36(1) is the only gate.

What is different for a public body

The DPO is mandatory. Article 37(1)(a) requires every public authority or body, other than a court acting in its judicial capacity, to designate a DPO, and 37(3) allows one DPO for several bodies. Under Article 39(1)(c) the DPO advises on the DPIA and monitors its performance, and under 39(1)(e) is the contact point for prior consultation, so the DPO owns the Article 36 file. Common platforms can be assessed once: Recital 92 says a DPIA may reasonably be broader than a single project “where public authorities or bodies intend to establish a common application or processing platform.” Publication is expected, not required: WP248 rev.01 says publishing is not a legal requirement and a summary will do, but calls it “particularly good practice” where the public is affected, “which could particularly be the case where a public authority carries out a DPIA.”

The record and the breach: Articles 30 and 33

Article 30(1) requires a record of processing activities containing the controller's and DPO's details, the purposes, the categories of data subjects and personal data, the categories of recipients including those in third countries, any third-country transfers with the documentation of safeguards, and where possible the erasure time limits and a general description of the Article 32 security measures; under 30(4) it is available to the authority on request. Those facts are the first half of a 35(7)(a) description, so an assessment should read from the record and write back to it. The 30(5) exemption for organisations under 250 staff falls away where processing is not occasional or involves special categories, which describes nearly every public body.

Article 33 sets the breach clock: notification to the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it,” unless the breach is unlikely to result in a risk, with reasons for any delay. The notification must describe the nature of the breach with approximate numbers of data subjects and records, name the DPO or other contact point, describe the likely consequences, and describe the measures taken or proposed; it may arrive in phases, and 33(5) requires every breach to be documented. Article 34 adds communication to the individuals, without undue delay, where the risk is high. A DPIA risk register that already states the consequences of illegitimate access, modification or loss is the fastest route to 33(3)(c) on day two.

Fines, and whether they reach public bodies

Article 83(4)(a) places the controller's obligations under “Articles 8, 11, 25 to 39 and 42 and 43” in the lower tier: fines up to €10 000 000 or, for an undertaking, up to 2% of total worldwide annual turnover, whichever is higher. A missing, late or inadequate DPIA and a skipped consultation fall here; processing unlawful in substance is fined under 83(5) at up to €20 000 000 or 4%. Among the 83(2) factors are the degree of responsibility “taking into account technical and organisational measures implemented” and how the infringement became known, so a documented assessment is evidence under both. Whether any of this reaches a public body is national: under 83(7) “each Member State may lay down the rules on whether and to what extent administrative fines may be imposed on public authorities and bodies.” What no Member State can exclude are the Article 58(2) corrective powers, including a temporary or definitive limitation or ban on the processing.

Building the programme

1. Start from the Article 30 record. Every activity in it is a candidate for screening; a programme that starts from projects misses the activities already running.
2. Write the screener from three sources: Article 35(3), your authority's 35(4) list, and the nine WP248 criteria with the two-criteria rule. Record the determination either way.
3. Adopt one template with the four 35(7) elements called out, tested against Annex 2 of WP248 rev.01.
4. Make the DPO's advice and data subjects' views dated steps, with the controller's decision on each recorded in the assessment.
5. Register risks and measures with owners and dates. The measures “envisaged” in 35(7)(d) must be implemented, and revisited under 35(11).
6. Decide the residual-risk question explicitly. If it is still high, open the Article 36 file with the 36(3) contents and a fourteen-week horizon; either way, set the review date and change-of-risk triggers on approval.

How AccessPoint runs it

AccessPoint's European Union GDPR jurisdiction pack ships a DPIA assessment type and template with the Regulation as the governing legal authority and the supervisory authority set per tenant; the Article 30 record lives on every privacy subject, breach response runs in the incident module beside it, and the EU AI Act deployer pack installs alongside for systems that also need an Article 27 fundamental-rights impact assessment. Templates are versioned and pack-maintained, and each assessment runs on its own derived copy, so a later template change never rewrites an approved record.

Breach response beside it computes the notification checklist from the governing legislation, with each obligation's recipient, due date and required contents, and a risk that materialises records the incident that realised it. Everything runs inside your own Microsoft 365 and Azure tenant, with the database in your Azure SQL and case documents in your own Blob Storage; the apps are distributed through Microsoft AppSource, where they are reviewed and tested by Microsoft.

A readiness checklist

• Confirm the Article 30 record is complete enough to screen from: purposes, categories, recipients, transfers, retention and security measures.
• Fold your supervisory authority's Article 35(4) and 35(5) lists into a screener with Article 35(3) and the nine WP248 criteria.
• Check whether national law under Article 36(5) requires prior authorisation, and whether any enabling law engages Article 35(10).
• Adopt a template that names the four Article 35(7) elements and test it against Annex 2 of WP248 rev.01.
• Record the DPO's advice, the controller's decision on it, and data subjects' views or the reasons they were not sought.
• Give every envisaged measure an owner and a date, and every accepted risk an approver and an expiry.
• Write the Article 36 procedure: the residual-risk decision, the 36(3) contents and a fourteen-week planning horizon.
• Set a review date on approval, define the Article 35(11) change-of-risk triggers, and align the breach procedure to Article 33's 72-hour clock.

Sources

• Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 30, 33, 34, 35, 36, 37, 39, 58 and 83 and Recitals 84, 89 to 94 and 97 — EUR-Lex (accessed September 4, 2026).
• Article 29 Working Party, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, WP248 rev.01 (adopted 4 April 2017, as last revised and adopted 4 October 2017) — European Commission newsroom (accessed September 4, 2026).
• European Data Protection Board, Endorsement 1/2018 (Brussels, 25 May 2018), endorsing WP248 rev.01 among other Working Party documents.
• EDPB Opinion 9/2018 on the draft list of the competent supervisory authority of France and Opinion 22/2018 on the draft list of the competent supervisory authority of the United Kingdom regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) — EDPB, 2018.

Related reading on this site: AccessPoint for GDPR and the EU AI Act, privacy impact assessment software, the companion guides on UK DPIAs under the UK GDPR and the Data Protection Act 2018 and algorithmic impact assessments, the PIA readiness check, a comparison with OneTrust, or book a demo to see an Article 35 assessment run end to end.

This guide is general information for data protection practitioners, not legal advice. Rely on the official text of Regulation (EU) 2016/679, your supervisory authority's published lists and guidance, and your organisation's counsel.