RCMIn brief
An impact assessment is needed when treatment is likely to create a high risk to people's rights and freedoms.
The decision depends on the context, scale, data, surveillance and vulnerability of people. A tool or sensitive data does not automatically trigger the same conclusion in all cases.
What to prepare
- Objective and scope of the processing or mission.
- Actors, tools, suppliers and flows concerned.
- Documents, contracts and decisions already available.
The criteria that trigger a DPIA
Article 35 of the GDPR requires a data protection impact assessment when processing is likely to result in a high risk. European guidelines list nine criteria; processing that meets at least two of them generally requires a DPIA:
- Evaluation or scoring of people, including profiling.
- Automated decisions with legal or similarly significant effects.
- Systematic monitoring, for example of employees or a public space.
- Sensitive or highly personal data.
- Large-scale processing.
- Matching or combining datasets.
- Vulnerable people: employees, patients, children.
- Innovative use or new technology.
- Processing that prevents people from exercising a right or using a service.
What a DPIA contains
- Description of the processing: purposes, data, people, recipients, retention and tools.
- Necessity and proportionality: legal basis, minimisation, information and individuals’ rights.
- Risk analysis: unauthorised access, unwanted modification, loss of data, and their consequences for people.
- Measures: technical and organisational measures that bring the risk to an acceptable level, with owners.
If a high risk remains despite the measures, the supervisory authority must be consulted before the processing starts (GDPR Article 36).
When should it be done?
A DPIA is carried out before the processing starts, ideally while the project is being designed, when a technical choice or a vendor can still be changed. It must then be reviewed when the processing changes significantly: new purpose, new data, new vendor or a change of scale.
What about Morocco?
Morocco’s Law 09-08 has no mechanism identical to the GDPR DPIA. Some processing does require prior authorisation from the CNDP, particularly when it involves sensitive data. For a Moroccan company subject to the GDPR, for example because it works for European clients, the DPIA remains the reference method for documenting risk.
Frequently asked questions
Is a DPIA mandatory for all processing? +
No. It is mandatory for processing likely to result in a high risk. For other processing, a short documented review of the criteria is often enough to justify the decision.
Who should carry out the DPIA? +
The controller is responsible for it. The DPO, if there is one, must be consulted; business teams, IT and processors provide the information needed.
How long does a DPIA take? +
It depends on the complexity of the processing: from a few days for a simple tool to several weeks for a project involving sensitive data and several vendors.
Boundaries
This content provides general information. It does not constitute legal advice tailored to any particular situation.
Ask a DPO →