Key takeaways
- A DPIA is required under GDPR Article 35 when processing is likely to result in high risk.
- The EU AI Act adds its own DPIA-related expectations.
- An Engage DPIA covers the assessment, the mitigations, and the documentation.
When a DPIA Is Required
Under GDPR Article 35, a DPIA must be conducted when processing is likely to result in a high risk to the rights and freedoms of individuals. Mandatory DPIA scenarios include:
- Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, where decisions produce legal effects or similarly significantly affect individuals
- Large-scale processing of special category data (health, racial origin, ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, sexual orientation, criminal data)
- Systematic monitoring of publicly accessible areas on a large scale
- Innovative use or application of new technological or organizational solutions
- Data transfers to third countries lacking adequate protection
- Cross-border data processing with significant individual impact
The European Data Protection Board (EDPB) and national supervisory authorities maintain lists of processing activities requiring DPIA. CNIL in France, BfDI and Landesdatenschutzbeauftragte in Germany, AP in the Netherlands, and ICO in the UK each maintain specific blacklists and guidance.
DPIA-equivalent assessments are not only an EU and UK requirement. US state privacy laws (Virginia, Colorado, Connecticut, Texas, and more) require data protection assessments for higher-risk processing, and comparable obligations appear in Brazil, Canada, China, and elsewhere. These obligations apply wherever your company is based: any company offering goods or services to people in the EU or UK can be in scope, not only European companies. We scope and deliver assessments across these regimes from a single engagement.
EU AI Act DPIA Requirements
Under the EU AI Act (high-risk AI systems: original deadline August 2, 2026, revised under the Digital Omnibus provisional agreement to 2 December 2027 and 2 August 2028, pending formal adoption), high-risk AI systems require a Fundamental Rights Impact Assessment (FRIA) which functions similarly to a DPIA but covers broader fundamental rights beyond data protection. Engage Compliance delivers integrated DPIA plus FRIA assessments for high-risk AI systems.
What an Engage DPIA Includes
Each DPIA delivered by Engage Compliance includes:
- Systematic description of the processing operation (purposes, data categories, data subject categories, recipients, retention)
- Assessment of necessity and proportionality
- Risk identification covering confidentiality, integrity, availability, and individual rights impact
- Risk evaluation with severity and likelihood scoring
- Mitigation measures including technical and organizational measures (TOMs)
- Residual risk assessment
- Consultation with supervisory authority where required under GDPR Article 36
- Stakeholder consultation documentation including data subjects where appropriate
- Data Protection Officer review and sign-off
- Living document setup for periodic review
Deliverables include the DPIA report (typically 15-40 pages depending on complexity), a stakeholder summary, and integration recommendations for the broader privacy program.
Industries Engage Serves for DPIA
DPIAs delivered across AI and ML companies (including high-risk AI under EU AI Act), HealthTech and digital health platforms, FinTech including credit scoring, fraud detection, and AML systems, HR Tech including employee monitoring, applicant tracking, and performance evaluation, Marketing and AdTech including programmatic advertising and tracking, biometric authentication systems, e-commerce including profiling and recommendation engines, IoT and connected device data flows, and cross-border data transfer programs.
Pricing
DPIA pricing depends on complexity and AI Act involvement:
- Standard DPIA: from €2,500 per assessment for typical processing scenarios with moderate complexity
- Complex DPIA: From €5,000 per assessment for AI systems, biometric processing, large-scale special category data, or cross-border transfer programs
- Integrated DPIA plus EU AI Act FRIA: from €7,500 per assessment for high-risk AI systems
- Multi-DPIA programs: discounted rates available for clients needing 5+ DPIAs in a coordinated program
DPIAs are included in DPO Essentials and DPO Premium retainer scopes at no additional cost up to specified annual volumes (typically 2-4 DPIAs per year). Additional DPIAs beyond the included volume are billed per assessment at retainer client rates.
Engagement Process
- Day 1-2: Kickoff call, stakeholder mapping, data inventory collection.
- Day 3-5: Processing description, necessity and proportionality assessment, risk identification.
- Day 6-8: Risk evaluation, mitigation measure design, TOMs documentation.
- Day 9-10: DPIA report finalization, sign-off, stakeholder summary delivery.
Total turnaround: typically 5-10 business days for standard scope. Expedited delivery (3-5 days) available for time-critical scenarios such as imminent regulator inquiry or enterprise deal block.