1. Introduction

A Data Protection Impact Assessment (DPIA) is a structured legal and technical assessment conducted before a proposed data-processing activity that is likely to create a high risk to individuals' rights and freedoms. It identifies privacy risks, evaluates whether the processing is necessary and proportionate, and establishes safeguards to prevent or reduce harm.

DPIAs are especially important where organisations use artificial intelligence, biometric identification, genetic databases, medical records, behavioural profiling, large-scale surveillance, or automated decision-making.

The central legal principle is privacy by design and accountability: organisations should identify and address foreseeable risks before processing begins, rather than waiting for a data breach, discriminatory outcome, or regulatory complaint. Under Article 35 of the EU General Data Protection Regulation (GDPR), a DPIA must be completed before high-risk processing starts.

Legislation.gov.uk+1

2. Meaning and legal nature of a DPIA

A DPIA is not merely an internal privacy checklist. It is a documented assessment of the proposed processing operation and its potential effects on individuals.

Its principal objectives are to:

Identify risks to privacy, dignity, autonomy, equality and other fundamental rights.

Test whether the proposed processing is necessary for a legitimate purpose.

Assess whether less intrusive alternatives are available.

Determine appropriate technical, organisational and legal safeguards.

Establish responsibility for approving, monitoring and reviewing the processing.

Provide evidence of compliance to regulators, courts and affected individuals where required.

A DPIA does not automatically make unlawful processing lawful. If the processing lacks a valid legal basis, violates purpose limitation, or remains unacceptably risky despite mitigation, the organisation may have to redesign or abandon it.

3. Principal legal frameworks

A. European Union — GDPR

Article 35 requires a DPIA where processing is likely to result in high risks to individuals. Article 35(3) identifies three particularly important categories: significant automated evaluation and decision-making, large-scale processing of sensitive data, and large-scale systematic monitoring of publicly accessible areas. Article 36 requires prior consultation with the supervisory authority if high residual risks remain.

Legislation.gov.uk+1

B. United Kingdom — UK GDPR

Article 35 of the UK GDPR establishes a similar DPIA framework. The applicable statutory text and regulatory guidance should be checked against amendments in force at the time of the assessment.

Legislation.gov.uk+1

C. India — Digital Personal Data Protection Act, 2023

Section 10 imposes additional obligations on a Significant Data Fiduciary (SDF), including periodic DPIAs, audits and due diligence concerning technical measures, as prescribed. Rule 13 of the notified Digital Personal Data Protection Rules, 2025 specifies a DPIA and audit at least once every 12 months for an SDF, together with reporting and algorithmic-risk obligations. The commencement provisions and applicable notifications must also be checked when determining the duties applicable to a particular organisation.

10+2

Important distinction: GDPR Article 35 establishes a risk-based DPIA duty for controllers generally when its legal threshold is met. India's DPDP framework specifically imposes the prescribed recurring DPIA obligations on notified Significant Data Fiduciaries. The two systems should not be treated as identical.

4. When is a DPIA required?

Under GDPR Article 35, the decisive question is whether the proposed processing is likely to result in a high risk to individuals' rights and freedoms. The three statutory examples are particularly important, but they are not an exhaustive list.

Legislation.gov.uk+1

The European Data Protection Board's guidance and national supervisory-authority lists help organisations determine whether a particular operation meets the threshold. Two or more high-risk indicators commonly strengthen the case for conducting a DPIA, but this is a practical screening heuristic, not a statutory minimum. One sufficiently serious risk may be enough.

European Data Protection Board+1

5. Mandatory contents of a DPIA

Article 35(7) GDPR establishes four core elements.

1. Systematic description of processing

Identify the data, individuals, collection methods, recipients, processing purposes, storage arrangements, retention periods and any legitimate interests relied upon.

2. Necessity and proportionality

Explain why each data category and processing operation is required, whether a less intrusive method exists, and how the activity complies with data minimisation and purpose limitation.

3. Assessment of risks

Evaluate the likelihood and severity of harms, including unauthorised disclosure, re-identification, discrimination, exclusion, identity theft, loss of confidentiality and interference with fundamental rights.

4. Risk-mitigation measures

Specify access controls, encryption, pseudonymisation, retention limits, testing, human oversight, incident response, accountability mechanisms and safeguards for individuals.

The controller must also seek the advice of its Data Protection Officer, where one has been designated, and consider the views of affected individuals or their representatives where appropriate. The assessment must be reviewed if the risks change.

Legislation.gov.uk+1

6. Step-by-step procedure for conducting a DPIA

Define the proposed processing. Document the purpose, technology, categories of data, people affected, recipients and data flows.

Screen for high risk. Apply Article 35, relevant regulator lists and the organisation's risk criteria. Record the reasons for conducting or not conducting a DPIA.

Establish necessity and proportionality. Identify the lawful basis, explain the purpose, test alternatives and limit collection to what is necessary.

Identify and assess risks. Consider both security threats and broader effects on individuals, including foreseeable misuse and discriminatory outcomes.

Select safeguards. Assign each risk a mitigation measure, responsible owner, completion date and verification method.

Consult relevant stakeholders. Involve the DPO, security specialists, legal teams, processors and affected people where appropriate.

Determine residual risk. Reassess risk after the proposed safeguards and confirm whether it is acceptable under the applicable legal framework.

Obtain appropriate approval and document the decision. If high residual risk remains under the GDPR, consult the supervisory authority before processing under Article 36.

Monitor and update. Review the DPIA when the system, purpose, data sources, technology, scale or risk profile materially changes.

A DPIA is therefore a continuing governance process, not simply a document completed once and filed away.

7. Important case laws on DPIAs and high-risk processing

A distinction is necessary between cases that directly interpret or enforce DPIA obligations and cases that establish broader privacy principles relevant to DPIAs. The following authorities illustrate both categories.

Case 1. Meta Platforms Ireland Ltd (Instagram) — Irish Data Protection Commission, 2 September 2022

Regulatory decision concerning GDPR Articles 24, 25 and 35

Facts: The Irish Data Protection Commission investigated Instagram's handling of users' contact information and public-by-default settings. The investigation included the exposure of email addresses and telephone numbers associated with certain business accounts, including accounts used by children.

Legal issue: Whether the controller had adequately assessed risks, implemented privacy-by-design safeguards and complied with its obligation to conduct a DPIA.

Decision: The Commission found infringements of several GDPR provisions, including Article 35, concerning the processing under investigation. It also addressed transparency, data minimisation and privacy-by-design obligations.

European Data Protection Board+1

Legal principle: Organisations cannot rely solely on a general assessment of legitimate interests where a proper DPIA is required. They must assess the actual processing operation, its risks and the safeguards needed to protect affected individuals.

Significance: This is a particularly useful direct authority for DPIA compliance, particularly where children's data, public disclosure and platform design are involved.

Case 2. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

Supreme Court of India · Constitutional privacy

Facts: A nine-judge Constitution Bench considered whether the right to privacy is protected as a fundamental right under the Indian Constitution.

Decision: The Court unanimously recognised privacy as a constitutionally protected fundamental right, grounded in the rights to life and personal liberty under Article 21 and the freedoms guaranteed by Part III.

The judgment also identified informational privacy as an important aspect of the right to privacy and called for a robust data-protection framework.

Indian Kanoon+1

Legal principle: Intrusions on privacy must satisfy legality, a legitimate state aim and proportionality.

Relevance to DPIAs: The judgment does not directly establish a statutory DPIA requirement. However, its proportionality framework provides a constitutional foundation for assessing whether high-risk government data-processing systems are justified, necessary and appropriately limited.

Case 3. Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (Schrems II), Case C-311/18, EU:C:2020:559

Court of Justice of the European Union · 16 July 2020

Facts: The dispute concerned transfers of personal data from the European Union to the United States and the protection available against access by public authorities.

Decision: The Court invalidated the EU–US Privacy Shield adequacy decision. It upheld the validity of standard contractual clauses in principle, while requiring an assessment of whether the law and practices in the destination country undermine the safeguards they are intended to provide.

Publications Office of the EU+1

Legal principle: Contractual safeguards alone are insufficient if the practical circumstances of processing prevent effective protection of individuals' rights.

Relevance to DPIAs: Although this is not a direct Article 35 DPIA judgment, it illustrates why risk assessments must consider the complete data lifecycle, including international transfers, third-country government access and the effectiveness of supplementary safeguards.

Case 4. Meta Platforms Ireland Ltd — Instagram regulatory decision, 2022

This regulatory matter also illustrates the relationship between a DPIA and the wider accountability framework.

Legal issue: Whether the controller's assessment and safeguards adequately addressed the risks of its processing practices.

Finding: The Irish regulator treated the absence of a required DPIA as a distinct compliance failure, alongside breaches relating to transparency, privacy by design and data minimisation.

European Data Protection Board+1

Principle: A DPIA must be substantive and operation-specific. A document that does not meaningfully assess risks or support effective safeguards will not necessarily satisfy the legal obligation.

Note: Cases 1 and 4 refer to the same regulatory decision and are presented separately to highlight its direct DPIA holding and broader accountability implications.

Case 5. Meta Platforms Ireland Ltd v. Data Protection Commission [2026] IEHC 323

Irish High Court · 21 May 2026

This recent proceeding concerns a challenge by Meta to the Data Protection Commission. It is relevant to the wider legal context of GDPR enforcement and regulatory decision-making.

Bailii

Caution: The available material does not establish a sufficiently verified holding from this judgment that should be cited as a new substantive rule on Article 35 DPIAs. It should not be presented as though it conclusively changes the DPIA standard.

Case-law comparison

8. DPIAs under Indian law

India's framework deserves separate treatment because the Digital Personal Data Protection Act, 2023 does not simply reproduce Article 35 GDPR.

A. Section 10 of the DPDP Act, 2023

Section 10 empowers the Central Government to designate a Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary, taking into account factors including:

Volume and sensitivity of personal data processed.

Risk to the rights of Data Principals.

Potential impact on India's sovereignty and integrity.

Risk to electoral democracy, security of the State and public order.

Significant Data Fiduciaries are subject to additional obligations, including DPIAs, audits and prescribed governance measures.

10+1

B. Rule 13 of the DPDP Rules, 2025

The notified Rules provide that a Significant Data Fiduciary must undertake a DPIA and audit at least once every 12 months. The framework also requires a report containing significant observations to be furnished to the Data Protection Board and due diligence regarding the risks posed by technical measures, including algorithmic software.

dpdpa.in+1

This means a covered organisation should not treat the assessment as a one-time exercise.

C. Relationship with Puttaswamy

The constitutional principles in Puttaswamy are particularly relevant where high-risk processing involves government databases, biometric identification, health information or large-scale profiling.

For public authorities, a defensible assessment should examine:

The legal authority for the proposed processing.

The legitimate public purpose.

Whether the scope of processing is proportionate to that purpose.

Whether less intrusive alternatives are available.

What safeguards, oversight and remedies protect affected people.

The constitutional judgment supplies the privacy principles; the specific statutory duties depend on the legislation and rules applicable to the processing.

9. Consequences of failing to conduct a DPIA

Under the GDPR, failure to conduct a required DPIA can expose an organisation to regulatory corrective measures and administrative fines. Article 83(4)(a) provides a maximum fine of €10 million or 2% of total worldwide annual turnover for the preceding financial year, whichever is higher, subject to the Regulation's conditions. More serious infringements of other GDPR provisions may attract a higher tier.

Potential consequences include:

Orders to conduct an assessment or bring processing into compliance.

Restrictions or suspension of processing.

Administrative fines.

Compensation claims where the applicable legal requirements are satisfied.

Reputational harm and loss of public confidence.

Increased exposure to claims involving discrimination, confidentiality or misuse of personal information.

In India, consequences depend on the applicable provisions and commencement status. Section 10 itself does not specify a standalone penalty for every DPIA failure; the Act's penalty framework and applicable Rules must be examined together.

10. Practical example: DPIA for an AI-based genomic risk platform

Consider a biotechnology company developing an AI system that analyses patients' genetic information to predict the likelihood of developing particular diseases.

Illustrative DPIA risk register

The company should document its lawful basis for processing, the purposes of genetic analysis, the categories of individuals affected, retention and deletion rules, and whether data will be used to train additional models.

It should then assess residual risks after mitigation. If the platform falls within GDPR Article 35 and high residual risk remains, the company must consult the relevant supervisory authority before proceeding. Where Indian law applies, it must separately determine whether it is a Significant Data Fiduciary and what obligations are in force for its activities.

11. Common legal mistakes

The following errors can undermine a DPIA's effectiveness:

Conducting the assessment after launch: Article 35 requires a DPIA before the relevant high-risk processing begins.

Treating consent as a complete solution: Consent does not eliminate risks or replace the need for a DPIA where one is required.

Ignoring non-security harms: Discrimination, exclusion, surveillance and loss of autonomy can be as important as data breaches.

Using generic templates without analysis: A template must be adapted to the specific technology, purpose, population and risks.

Failing to assess residual risk: The organisation must consider whether safeguards actually reduce the identified risks.

Ignoring significant system changes: Material changes to data sources, models, purposes or processing scale may require reassessment.

Assuming anonymisation eliminates every risk: Re-identification and linkage risks must be evaluated where relevant.

12. Conclusion

Data Protection Impact Assessments are a central mechanism for making high-risk data processing accountable, proportionate and rights-respecting. GDPR Article 35 establishes the core assessment requirements, while Article 36 provides for supervisory-authority consultation where high residual risk remains.

The leading direct regulatory example discussed here is the Irish DPC's 2022 Instagram decision. Puttaswamy provides an important constitutional foundation in India, and Schrems II illustrates the need to examine whether safeguards remain effective in practice.

For organisations operating in India, the DPDP Act and notified 2025 Rules require particular attention to Significant Data Fiduciary status, recurring assessments, audits and algorithmic-risk governance. A legally defensible DPIA should identify the real risks, explain why the processing is necessary, document effective safeguards and remain current throughout the processing lifecycle.

This is a general legal research overview, not a substitute for advice on a specific processing operation or jurisdiction.

Primary sources and further reading

GDPR Article 35 — Statutory text.

European Data Protection Board — DPIA guidelines.

Ministry of Electronics and Information Technology — Official ministry website.

Justice K.S. Puttaswamy (Retd.) v. Union of India — Judgment text.

Data Protection Commissioner v. Facebook Ireland Ltd and Schrems, C-311/18 — CJEU judgment.