Data Protection Impact Assessment (DPIA)

A data protection impact assessment (DPIA) is a structured risk analysis required by Article 35 GDPR before processing that is likely to result in a high risk to people. It describes the processing, tests whether it is necessary and proportionate, assesses the risks and sets out measures to reduce them.

What is a data protection impact assessment?

A data protection impact assessment, or DPIA, is a documented risk check you carry out before you start a processing activity that is likely to result in a high risk to the rights and freedoms of individuals. It is required by Article 35 of the GDPR and the UK GDPR. Think of it as a structured pause: before a new tool or process goes live, you write down what could go wrong for the people whose data you use, and what you will do about it.

A DPIA answers four core questions:

  1. What exactly happens? A systematic description of the processing, its purposes and, where relevant, your legitimate interests.
  2. Is it necessary? An assessment of whether the processing is necessary and proportionate to the purpose.
  3. What are the risks? An assessment of the risks to individuals, by likelihood and severity.
  4. How do you reduce them? The safeguards, security measures and mechanisms you will use, such as your technical and organisational measures.

When is a DPIA required, and why does it matter?

Article 35(3) names three cases where a DPIA is always required:

  • Systematic and extensive evaluation of people based on automated processing, including profiling, that leads to decisions with legal or similarly significant effects
  • Large-scale processing of special category data (such as health data) or criminal offence data
  • Systematic monitoring of a publicly accessible area on a large scale

On top of that, supervisory authorities publish their own lists of processing types that need a DPIA. In the UK, the Information Commissioner’s Office (ICO) lists, among others, innovative technology, denial of service based on automated decisions, large-scale profiling and tracking. Using AI on customer or applicant data is a typical trigger worth checking.

Why it matters for a small business:

  • Fines: failing to carry out a required DPIA is a breach in itself. Under Article 83(4), fines can reach up to €10 million or 2% of worldwide annual turnover.
  • Prior consultation: if the DPIA shows a high risk that you cannot reduce, Article 36 requires you to consult the supervisory authority before you start.
  • Better decisions: a DPIA often reveals simple fixes early, such as collecting less data, shortening retention or restricting access, before they become expensive to change.

Example: a recruitment agency in Manchester

A recruitment agency in Manchester wants to use an AI agent on WhatsApp to pre-screen applicants: it asks about experience, availability and salary expectations, then suggests which candidates a consultant should call back first.

That is innovative technology combined with an evaluation of people that can affect their access to work, so the agency runs a DPIA. It describes the data flow, documents why each question is necessary, and identifies the main risk: applicants being filtered out by an automated ranking without a human looking at their case. The measures it agrees on are clear. The AI only prepares a summary; a consultant makes every decision. Applicants are told up front that they are chatting with an AI and can ask for a person at any time. Screening chats are deleted after a defined period under the agency’s data retention policy, and the messaging platform’s DPA and security measures are attached to the assessment.

DPIAs and SendSeven

To be clear: SendSeven does not carry out your DPIA for you. As controller, that responsibility stays with you. What we provide is the information you need for the parts that concern us as processor:

  • Hosted in the EU (Frankfurt, Google Cloud), with platform and database in European data centres
  • Encrypted in transit (TLS) and at rest
  • Role-based access control with custom roles
  • A DPA under Article 28 (see data processing agreement)
  • Optional AI: off by default, runs in the EU, your data is never used for model training

Your DPIA should also cover the channels themselves: WhatsApp, Instagram and Messenger messages are processed by Meta under its own terms, partly outside the EU. More in GDPR-compliant messaging.

This is general information, not legal advice. Check the details with your data protection lead or compliance consultant.