Do you need a DPIA? Ireland has its own list, and it is specific

Article 35(1) of the GDPR requires a data protection impact assessment where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, and it requires it before the processing starts.

Article 35(3) names three cases where one is required regardless: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal or similarly significant effects; processing on a large scale of special category data or of criminal conviction and offence data; and systematic monitoring of a publicly accessible area on a large scale.

Article 35(4) then lets each supervisory authority publish its own list of processing operations that require one. The Data Protection Commission has done that, and its list is what settles the question for an Irish controller.

The DPC's list has ten items. It carries a condition at the top that is routinely dropped when the list is reproduced, and the condition is doing real work: the ten apply where a documented screening or preliminary risk assessment indicates that the processing operation is likely to result in a high risk.

So the list does not fire by itself. Something has to indicate the risk first, and that something is a screening. Which is exactly why a screening is the honest first step and why it can be automated when a full assessment cannot.

The items are quoted below rather than paraphrased. Paraphrasing a statutory list is how a check ends up telling somebody they are clear when the regulator's own words say otherwise.

Items 4 and 9 are the ones worth reading twice, because between them they describe a normal marketing setup rather than anything exotic.

Item 4 is systematically monitoring, tracking or observing individuals' location or behaviour. That is what an advertising pixel does. It is what session recording and heatmaps do. Aggregate visitor counts are not it; anything tied to an identifier that follows a person between pages or between visits is.

Item 9 is combining, linking or cross-referencing separate datasets where such linking significantly contributes to or is used for profiling or behavioural analysis of individuals, particularly where the datasets are combined from different sources where processing was carried out for different purposes or by different controllers. That is what a joined-up dashboard does when it puts an ad platform, an analytics property and a payment processor on the same customer.

We should say plainly that the second one describes work we sell. The reporting product this company builds joins exactly those sources. If the join is used for behavioural analysis of individuals rather than for totals, item 9 is engaged, and it is better that you read that here than hear it from a client's solicitor.

The Article 29 Working Party's guidelines, WP248 rev.01, endorsed by the European Data Protection Board, set out nine criteria: evaluation or scoring; automated decision-making with legal or similar significant effect; systematic monitoring; sensitive data or data of a highly personal nature; data processed on a large scale; matching or combining datasets; vulnerable data subjects; innovative use of new technologies; and processing that prevents data subjects from exercising a right or using a service or a contract.

The rule of thumb attached to those is quoted much more firmly than it was written. What WP248 actually says is that in most cases a controller can consider that processing meeting two criteria would require a DPIA. Can consider, not must. It is a heuristic, and a single criterion can be enough where the risk is high.

For an Irish controller the ordering is: the DPC's list first, because it is the Article 35(4) instrument that binds here; the WP29 criteria second, as the analysis that fills the gaps.

Article 36(1) requires prior consultation with the supervisory authority where the DPIA indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate it. In other words, you consult where your own assessment says you cannot get the risk down, not merely because a DPIA was needed.

The timing under Article 36(2) is worth knowing before anybody plans a launch around it. The authority provides written advice within a period of up to eight weeks of receiving the request, and that period may be extended by six weeks. The extension has to be notified within one month of receipt, and the clock can be suspended while the authority waits for information it has asked for.

Fourteen weeks, in the worst case, before you get an answer. That is the argument for doing the screening early rather than the week before go-live.

It is not a form, and it is not a document you buy. Article 35(7) sets the minimum contents: a systematic description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to data subjects, and the measures you propose to address them.

It is also not the same as a lawful basis. An assessment that concludes the risk is manageable does not supply a legal ground for the processing, and neither does the fact that nobody objected.

And it is not required for everything. A great deal of ordinary business processing, including payroll, order fulfilment and a customer list used for the thing it was collected for, sits outside the list and outside Article 35(3). The most common outcome of an honest screening is that no assessment is mandatory.

Three of the questions on this site end up back here. Automated decisions about job candidates engage item 3 about as clearly as the wording allows. Automating a process that moves personal data between systems frequently engages item 1 or item 9. And a privacy notice describes processing that sometimes needed an assessment before it started, which is an awkward thing to discover while writing the notice.

The AI Act connection runs the other way from how it is usually presented. Article 27 of the AI Act, the fundamental rights impact assessment, does not bind most private businesses. Article 35 of the GDPR binds anybody whose processing is on the list, has done since 2018, and is enforced by a regulator with a published decision record.

The order that answers the cheapest question first.