A Data Protection Impact Assessment is the written risk assessment GDPR Article 35 requires before you start processing that is likely to result in a high risk to people, such as large-scale health data, profiling that drives significant decisions, or systematic monitoring. Engage Compliance writes the DPIA for you, designs the mitigations, signs it off as your DPO and, where the risk stays high, handles the Article 36 consultation with the supervisory authority. A standard scope takes 5 to 10 business days. If the DPIA sits alongside a vendor due diligence request or an EU AI Act assessment, we scope them together so the same facts are only gathered once.
Key takeaways
- A DPIA is required under GDPR Article 35 when processing is likely to result in high risk.
- The EU AI Act adds its own DPIA-related expectations.
- An Engage DPIA covers the assessment, the mitigations, and the documentation.
- Engage Compliance writes the DPIA and, where the risk stays high, handles the Article 36 consultation.
When is a DPIA required?
Under GDPR Article 35, a DPIA must be conducted when processing is likely to result in a high risk to the rights and freedoms of individuals. Mandatory DPIA scenarios include:
- Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, where decisions produce legal effects or similarly significantly affect individuals
- Large-scale processing of special category data (health, racial origin, ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, sexual orientation, criminal data)
- Systematic monitoring of publicly accessible areas on a large scale
- Innovative use or application of new technological or organizational solutions
- Data transfers to third countries lacking adequate protection
- Cross-border data processing with significant individual impact
The European Data Protection Board (EDPB) and national supervisory authorities maintain lists of processing activities requiring DPIA. CNIL in France, BfDI and Landesdatenschutzbeauftragte in Germany, AP in the Netherlands, and ICO in the UK each maintain specific blacklists and guidance.
DPIA-equivalent assessments are not only an EU and UK requirement. US state privacy laws (Virginia, Colorado, Connecticut, Texas, and more) require data protection assessments for higher-risk processing, and comparable obligations appear in Brazil, Canada, China, and elsewhere. These obligations apply wherever your company is based: any company offering goods or services to people in the EU or UK can be in scope, not only European companies. We scope and deliver assessments across these regimes from a single engagement.
What does the EU AI Act add to a DPIA?
Under the EU AI Act (high-risk AI systems: original deadline August 2, 2026, revised under the Digital Omnibus to 2 December 2027 for stand-alone systems and 2 August 2028 for AI embedded in regulated products, now formally adopted), high-risk AI systems require a Fundamental Rights Impact Assessment (FRIA) which functions similarly to a DPIA but covers broader fundamental rights beyond data protection. Engage Compliance delivers integrated DPIA plus FRIA assessments for high-risk AI systems.
What does an Engage DPIA include?
Each DPIA delivered by Engage Compliance includes:
- Systematic description of the processing operation (purposes, data categories, data subject categories, recipients, retention)
- Assessment of necessity and proportionality
- Risk identification covering confidentiality, integrity, availability, and individual rights impact
- Risk evaluation with severity and likelihood scoring
- Mitigation measures including technical and organizational measures (TOMs)
- Residual risk assessment
- Consultation with supervisory authority where required under GDPR Article 36
- Stakeholder consultation documentation including data subjects where appropriate
- Data Protection Officer review and sign-off
- Living document setup for periodic review
Deliverables include the DPIA report (typically 15-40 pages depending on complexity), a stakeholder summary, and integration recommendations for the broader privacy program.
Which industries do you write DPIAs for?
DPIAs delivered across AI and ML companies (including high-risk AI under EU AI Act), HealthTech and digital health platforms, FinTech including credit scoring, fraud detection, and AML systems, HR Tech including employee monitoring, applicant tracking, and performance evaluation, Marketing and AdTech including programmatic advertising and tracking, biometric authentication systems, e-commerce including profiling and recommendation engines, IoT and connected device data flows, and cross-border data transfer programs.
How much does a DPIA cost?
DPIA pricing depends on complexity and AI Act involvement:
- Standalone DPIA: from €2,500 per assessment for companies not on a retainer, scaling with complexity
- Complex scopes (AI systems, biometric processing, large-scale special category data, cross-border transfer programs) and integrated DPIA plus EU AI Act FRIA work are scoped and quoted individually from that same floor
- Multi-DPIA programs: discounted rates available for clients needing 5+ DPIAs in a coordinated program
DPIAs are included in DPO Partner and DPO Complete retainer scopes. Privacy Advisory and DPO Foundation clients are billed at the preferential client rate of €1,000 per assessment.
How does a DPIA engagement work?
- Day 1-2: Kickoff call, stakeholder mapping, data inventory collection.
- Day 3-5: Processing description, necessity and proportionality assessment, risk identification.
- Day 6-8: Risk evaluation, mitigation measure design, TOMs documentation.
- Day 9-10: DPIA report finalization, sign-off, stakeholder summary delivery.
Total turnaround: typically 5-10 business days for standard scope. Expedited delivery (3-5 days) available for time-critical scenarios such as imminent regulator inquiry or enterprise deal block.
If you want an outside check across the whole program rather than one assessment, our GDPR audit services are the usual starting point.
Sources and references
- Regulation (EU) 2016/679 (GDPR), official text, EUR-Lex
- Article 29 Working Party Guidelines on Data Protection Impact Assessment (WP248 rev.01), endorsed by the EDPB, European Commission (Article 29 Working Party archive)
- ICO (UK): Data protection impact assessments, Information Commissioner’s Office (UK)
- Regulation (EU) 2024/1689 (EU AI Act), official text, EUR-Lex
- Code of Virginia, Chapter 53: Consumer Data Protection Act, Virginia Law (Virginia Code Commission)
- Colorado Senate Bill 21-190 (Colorado Privacy Act), signed text, Colorado General Assembly
- Texas Data Privacy and Security Act, Texas Attorney General