Do you need a DPIA? Ireland has its own list, and it is specific

Article 35(1) of the GDPR requires a data protection impact assessment where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, and it requires it before the processing starts.

Article 35(3) names three cases where one is required regardless: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal or similarly significant effects; processing on a large scale of special category data or of criminal conviction and offence data; and systematic monitoring of a publicly accessible area on a large scale.

Article 35(4) then requires each supervisory authority to establish and publish a list of the kinds of processing operations that need one, and to send it to the European Data Protection Board. The Data Protection Commission has done that. Its list adds to Article 35(1) and (3) and does not replace them. The DPC says the list is not exhaustive and is without prejudice to Article 35(3).

The DPC's list has ten items. It has a condition at the top, and the condition matters. The ten apply where a documented screening or preliminary risk assessment indicates that the processing operation is likely to result in a high risk.

The list does not apply by itself. Something has to indicate the risk first, and that something is a screening. A screening is the first step, and it can be automated where a full assessment cannot.

The items are quoted below in the DPC's own words.

Items 4 and 9 are the ones worth reading twice, because between them they describe an advertising pixel and a joined-up dashboard.

Item 4 is systematically monitoring, tracking or observing individuals' location or behaviour. That is what an advertising pixel does. Session recording that replays an identifiable visitor's journey through the site fits the same words. Total visitor counts are not covered. An identifier that follows a person between pages or visits, so that their behaviour can be recorded, analysed or used to target them, is covered. A session cookie that only remembers a shopping basket, which the DPC treats as strictly necessary, is a different thing.

Item 9 is combining, linking or cross-referencing separate datasets where such linking significantly contributes to or is used for profiling or behavioural analysis of individuals, particularly where the datasets are combined from different sources where processing was carried out for different purposes or by different controllers. That is what a joined-up dashboard does when it links data about the same customer from an ad platform, an analytics property and a payment processor, and is used to analyse how that customer behaves.

The second one describes work we sell. The reporting we build joins data from separate sources. If the join is used for behavioural analysis of individuals, and not only for totals, item 9 comes into play.

The Article 29 Working Party's guidelines, WP248 rev.01, endorsed by the European Data Protection Board, set out nine criteria: evaluation or scoring; automated decision-making with legal or similar significant effect; systematic monitoring; sensitive data or data of a highly personal nature; data processed on a large scale; matching or combining datasets; vulnerable data subjects; innovative use of new technologies; and processing that prevents data subjects from exercising a right or using a service or a contract.

The firmer version, that two criteria "will require" a DPIA, comes from the first version of the guidelines adopted in April 2017, and the DPC's own DPIA page still uses it. The revised version, WP248 rev.01, says that in most cases a controller can consider that processing meeting two criteria would require a DPIA. "Can consider", not "must". It is a rule of thumb, and a single criterion can be enough where the risk is high.

For an Irish controller, work in this order. First, the three Article 35(3) cases and the DPC's list, which is Ireland's Article 35(4) list and itself relies on the WP29 criteria for items 6 and 7. Then the WP29 criteria, to test anything else against Article 35(1), which applies to processing on a list and off it.

Article 36(1) requires prior consultation with the supervisory authority where the DPIA indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate it. In other words, you consult where your own assessment says you cannot get the risk down, not merely because a DPIA was needed.

The timing under Article 36(2) matters for a launch date. If the DPC considers that the processing would infringe the GDPR, it must give written advice within up to eight weeks of receiving the request, and that period may be extended by six weeks. The extension has to be notified within one month of receipt, and the clock can be suspended while the authority waits for information it has asked for.

That is up to fourteen weeks, plus any time the clock is suspended while the DPC waits for information it asked for. Article 36(2) sets that deadline only where the DPC thinks the processing would infringe the GDPR. Screen early enough to allow for it.

It is not a form, and it is not a document you buy. Article 35(7) sets the minimum contents: a systematic description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to data subjects, and the measures you propose to address them.

It is also not the same as a lawful basis. An assessment that concludes the risk is manageable does not supply a legal ground for the processing, and neither does the fact that nobody objected.

And it is not required for everything. For a small business, payroll, order fulfilment and a customer list used for the purpose it was collected for do not match any of the ten items or the three cases in Article 35(3). A large employer processing health data for sick pay should check item 10, because section 46 of the Data Protection Act 2018 allows special category data to be processed for employment law purposes only subject to suitable and specific measures. An honest screening can conclude that no assessment is mandatory, and the DPC expects that conclusion to be recorded as well.

Three of the questions on this site end up back here. Automated decisions about job candidates bring in item 3. Automating a process that moves personal data between systems brings in item 1 if it puts data to a new purpose on a large scale, and item 9 if the linking is used for profiling or behavioural analysis of individuals. And a privacy notice describes processing that sometimes needed an assessment before it started.

The AI Act connection is narrower. Article 27 of the AI Act, the fundamental rights impact assessment, applies only to certain deployers of high-risk AI systems: public bodies, private entities providing public services, and deployers of credit scoring and life and health insurance pricing systems. It does not apply before 2 December 2027. Article 35 of the GDPR has bound controllers of every size since 25 May 2018, and it is enforced by a regulator with a published decision record.

In this order.