Free check

Does what you are building need an assessment first?

Article 35 of the GDPR requires a Data Protection Impact Assessment before certain processing begins. Not afterwards. The Irish Data Protection Commission has published a list of exactly which kinds, and 9 of its ten items are questions you can answer about your own business right now.

The list binds where a documented screening or preliminary risk assessment indicates the processing is likely to result in a high risk. This page is that screening. It says which items your answers put you on, and you can print the result as the record that you did it.

Two of them catch ordinary marketing work, which is the reason this page exists. Tracking what individual people do is on the list in its own right. So is joining data from separate systems to build a picture of individual customers, which is what a joined-up reporting setup does, including ours.

The answers stay in this tab and we never see them unless you ask us to email you the result. This is a screening against a published list, which is the first step of a DPIA and the only step that can honestly be automated. It is not the assessment and it is not legal advice.

FourWinds Digital · fourwindsdigital.com

Do you need a DPIA?

GDPR Article 35, and the Data Protection Commission's Article 35(4) list

A scoping result produced from the answers given on the page. It says which conversation you are in. It is not legal advice, and it is current as at the date it was printed.

This is a scoping result worked out from your own answers. It tells you which conversation you are in. It is not legal advice, and it is not a determination that you comply.

Optional, and nothing in the answer depends on it. It goes onto the result if you print it, so the document says who it was run for.

What was answered

Does your website or app track what individual people do?
01Does your website or app track what individual people do? Not answered

Does your website or app track what individual people do?

Analytics with user-level data, an advertising pixel, session recording, heatmaps, or anything that follows a person from page to page or across visits. Aggregate counts of visitors do not count; anything tied to an identifier does.

Do you combine data from separate systems to build a picture of individual customers?
02Do you combine data from separate systems to build a picture of individual customers? Not answered

Do you combine data from separate systems to build a picture of individual customers?

Joining your ad platform to your analytics to your payments or CRM, so you can see what a given person did and what they were worth. If the join is only ever used for totals, say no. If it is used to segment, score or target people, say yes.

Does software decide, or materially influence, who gets a service, a price or a job?
03Does software decide, or materially influence, who gets a service, a price or a job? Not answered

Does software decide, or materially influence, who gets a service, a price or a job?

CV sifting, credit or affordability scoring, dynamic pricing per person, automated approval or refusal. It counts even where a human signs it off, if the human is following the score.

Do you target marketing at children, patients or other vulnerable people?
04Do you target marketing at children, patients or other vulnerable people? Not answered

Do you target marketing at children, patients or other vulnerable people?

Under-18s, people receiving care, people in financial difficulty. Targeting means choosing them, not merely having some among your customers.

Are you about to use data you already hold for something new?
05Are you about to use data you already hold for something new? Not answered

Are you about to use data you already hold for something new?

Using a customer list for marketing when it was collected to fulfil orders, or training a model on records collected for another reason. At scale, this is the item.

Do you profile people at scale?
06Do you profile people at scale? Not answered

Do you profile people at scale?

Scoring, segmenting or predicting behaviour across a large customer base. There is no fixed number; the regulator looks at how many people, how much data, how long and how wide the reach.

Do you hold personal data you got from somewhere other than the person, without telling them?
07Do you hold personal data you got from somewhere other than the person, without telling them? Not answered

Do you hold personal data you got from somewhere other than the person, without telling them?

Prospect lists, scraped or bought data, data from a partner. The item is engaged where you rely on an exemption from telling them because it would be impossible or take disproportionate effort.

Do you use biometrics to identify or verify anybody?
08Do you use biometrics to identify or verify anybody? Not answered

Do you use biometrics to identify or verify anybody?

Face recognition, fingerprint entry, voice identification. Staff clocking-in systems are the common one in small businesses.

Do you process genetic data?
09Do you process genetic data? Not answered

Do you process genetic data?

Rare outside healthcare and research, and asked because the list names it.

0 of 9 answered.

If the answer is yes

A DPIA is a document with a shape: what the processing is, why it is necessary and proportionate, what could go wrong for the people in it, and what you have done about that. It sits on top of your record of processing, which is why we write the record first and the assessment from it.

What a DPIA costsTalk to us

The other free checks: which AI Act duties you owe, whether the Cyber Resilience Act reaches you, and whether the Accessibility Act already applies.