July 2026. GDPR requires a DPIA for processing likely to result in high risk — large-scale monitoring, sensitive data, AI profiling or new SaaS with PII. AP supervision and enterprise due diligence increasingly ask: where is the DPIA and when was it reviewed?
Triggers for DPIA
- new processing or major change to existing;
- systematic monitoring of staff or customers;
- sensitive categories at scale;
- AI/automated decision-making impacting individuals;
- transfer outside EEA without adequacy.
Process and evidence
DPO involved, risks and mitigations recorded, go/no-go decision. Review on scope, vendor or technology change. Link to privacy hub, ISO 27701 and ISMS risk register.
Internal audit sample: pick one processing with PII and follow chain DPIA → SoA → contract → technical measures.
Negative DPIA decision (“not needed”) must be justified — supervisors do not accept blank checklists.
Review and living document
DPIA is a living document — review on new feature, vendor, data classification or AI model. Version control and DPO approval in file.
Link DPIA mitigations to SoA controls and tickets — auditors follow chain from risk to implementation.
Negative DPIA: justify with concrete criteria (no sensitive categories at scale, no profiling) — supervisors sample checks.
Next steps in your ISMS
Turn this article into one concrete action in your risk register or improvement plan: owner, deadline, expected evidence. Discuss progress in the next management review — auditors and chain partners want decisions, not policy intent alone. Link where possible to existing ISO 27001, NIS2 or GDPR documentation so you do not maintain parallel folders.
Questions on scope, certification or chain requirements? Use our readiness overview and knowledge base for deeper guidance. This article does not replace legal or audit advice for your situation.
Share relevant findings briefly with line management and procurement — compliance becomes workable when the whole organisation recognises the same priorities. Repeat the chosen action quarterly in team meetings and update evidence locations in your SoA or control plan so surveillance samples are easy to answer.
What to do this week
Pick one concrete action from this article, assign an owner and add it to your risk or improvement register with a deadline. Share briefly in team meetings so compliance is something the line recognises. Repeat quarterly in management review so leadership sees progress, not only intent.
Note: this article is educational and does not replace legal, privacy or audit advice for your specific situation.
Evidence and governance
Record who owns the measures in this article and how you prove operation in the sample period — logs, tickets, approved changes or exercise reports. Certification bodies and chain partners do not accept intent without samples. Link evidence locations to your SoA or control plan so internal and external audit use the same sources.
Chain and contracts
Many 2026 requirements come via customers, not only formal law scope. Align contract SLAs with your ISMS: incident notification, audit rights, patch timelines and exit. Document where contract is stricter than internal policy — management review must explicitly accept that gap or plan investment.
Continual improvement
Plan a short quarterly review: what worked, which near-miss stood out, which control needs extra attention? Record three improvement actions with owners — that is what ISO 27001, NIS2 and GDPR supervision want to see: PDCA in practice, not paper only.
Knowledge base and readiness
For deeper guidance see our knowledge base on ISMS, ISO 27001, NIS2 and GDPR. Use the readiness overview to compare priorities with your current maturity. This article is educational; engage specialists for legal or audit decisions.
Evidence and governance
Record who owns the measures in this article and how you prove operation in the sample period — logs, tickets, approved changes or exercise reports. Certification bodies and chain partners do not accept intent without samples. Link evidence locations to your SoA or control plan so internal and external audit use the same sources.
Chain and contracts
Many 2026 requirements come via customers, not only formal law scope. Align contract SLAs with your ISMS: incident notification, audit rights, patch timelines and exit. Document where contract is stricter than internal policy — management review must explicitly accept that gap or plan investment.
Continual improvement
Plan a short quarterly review: what worked, which near-miss stood out, which control needs extra attention? Record three improvement actions with owners — that is what ISO 27001, NIS2 and GDPR supervision want to see: PDCA in practice, not paper only.