July 2026. GDPR requires a DPIA for processing likely to result in high risk — large-scale monitoring, sensitive data, AI profiling or new SaaS with PII. AP supervision and enterprise due diligence increasingly ask: where is the DPIA and when was it reviewed?
Triggers for DPIA
- new processing or major change to existing;
- systematic monitoring of staff or customers;
- sensitive categories at scale;
- AI/automated decision-making impacting individuals;
- transfer outside EEA without adequacy.
Process and evidence
DPO involved, risks and mitigations recorded, go/no-go decision. Review on scope, vendor or technology change. Link to privacy hub, ISO 27701 and ISMS risk register.
Internal audit sample: pick one processing with PII and follow chain DPIA → SoA → contract → technical measures.
Negative DPIA decision (“not needed”) must be justified — supervisors do not accept blank checklists.
Review and living document
DPIA is a living document — review on new feature, vendor, data classification or AI model. Version control and DPO approval in file.
Link DPIA mitigations to SoA controls and tickets — auditors follow chain from risk to implementation.
Negative DPIA: justify with concrete criteria (no sensitive categories at scale, no profiling) — supervisors sample checks.
Next steps in your ISMS
Turn this article into one concrete action in your risk register or improvement plan: owner, deadline, expected evidence. Discuss progress in the next management review — auditors and chain partners want decisions, not policy intent alone. Link where possible to existing ISO 27001, NIS2 or GDPR documentation so you do not maintain parallel folders.
Questions on scope, certification or chain requirements? Use our readiness overview and knowledge base for deeper guidance. This article does not replace legal or audit advice for your situation.
Share relevant findings briefly with line management and procurement — compliance becomes workable when the whole organisation recognises the same priorities. Repeat the chosen action quarterly in team meetings and update evidence locations in your SoA or control plan so surveillance samples are easy to answer.