How to conduct a Data Protection Impact Assessment (DPIA): A step-by-step approach 

Table Of Contents

Overview  #

A Data Protection Impact Assessment (DPIA) is a systematic process used to identify, assess, and mitigate risks to the rights and freedoms of individuals arising from the processing of personal data. Under Article 35 of the General Data Protection Regulation (GDPR), a DPIA is mandatory where processing is likely to result in a high risk to individuals. Such ‘high risk’ occurs when there is systematic monitoring of individuals (e.g., genetic profiling), a special category of data at stake (e.g., health/genetic/biometric) is processed on a large scale, new technologies or AI are used, there’s automated decision-making with significant effects. Indeed, DPIA is of utmost importance in the areas of health, biomedical research, and biobanking, giving that these fields often involve:   

  • Sensitive data: Genetic, biometric, health, and lifestyle data  
  • Large-scale processing: Long-term storage and secondary uses in research  
  • Vulnerable data subjects: Including minors, elderly, or rare disease patients  
  • Innovative technologies: AI, genomic sequencing, data linkage, cloud sharing  

In biobanking and biomedical research, a DPIA should ideally be initiated during the planning phase of the project and updated whenever substantial changes occur in the processing activities. 

The Data Protection Working Party WP29 identified nine criteria that should consider evaluating if a process is likely to result in a high risk for the rights and the freedom of the data subject. For European research projects, the criteria are specified in the guidance for the ethics self-assessment. The DPIA process aims to ensure that controllers adequately address privacy and data protection risks of ‘risky’ processing operations. By providing a structured way of thinking about the risks to data subjects and how to mitigate them, DPIAs help organisations to comply with the requirement of ‘data protection by design’.    

DPIAs help ensure:  

  • Ethical compliance and trustworthiness  
  • Legal compliance with GDPR  
  • Transparency and accountability  
  • Protection against data breaches and misuse  

A DPIA is not just a bureaucratic step, but a tool for:  

  • Fostering data ethics and public trust  
  • Ensuring participant autonomy  
  • Enabling responsible innovation in science  

The DPIA process aims to ensure that controllers adequately address privacy and data protection risks of ‘risky’ processing operations. By providing a structured way of thinking about the risks to data subjects and how to mitigate them, DPIAs help organisations to comply with the requirement of ‘data protection by design’.    

Ten steps to follow #

Step 1 – Determine whether a DPIA is required  #

Begin by assessing whether the planned processing is likely to present a high risk to the rights and freedoms of data subjects. 

A DPIA is generally required when the processing involves one or more of the following: 

  • processing of special categories of personal data (e.g., health or genetic data) on a large scale; 
  • innovative technologies such as artificial intelligence or machine learning; 
  • systematic or large-scale profiling; 
  • combining datasets from multiple sources; 
  • international transfers of personal data; 
  • processing involving vulnerable individuals (e.g., children or patients); 
  • systematic monitoring of individuals. 

Step 2 – Describe the processing  #

Clearly document the proposed processing activities. 

This description should include: 

  • the objectives of the project; 
  • categories of personal data processed; 
  • categories of data subjects; 
  • sources of the data; 
  • recipients of the data; 
  • data flows; 
  • storage periods; 
  • international data transfers; 
  • roles and responsibilities of controllers, joint controllers, processors, and third parties. 

Step 3 – Identify the legal basis  #

Determine the legal basis for each processing activity under the GDPR. 

Where special categories of personal data are processed, identify both: 

  • the applicable legal basis under Article 6 GDPR, and 
  • the relevant condition under Article 9 GDPR. 

For research projects, also consider any applicable national legislation implementing Article 9(2)(j) GDPR concerning scientific research. 

Step 4 – Assess Necessity and Proportionality  #

Evaluate whether the processing is necessary to achieve the research objectives and whether less intrusive alternatives exist. 

This assessment should consider: 

  • data minimisation; 
  • purpose limitation; 
  • storage limitation; 
  • transparency; 
  • fairness; 
  • accuracy; 
  • accountability; 
  • participants’ rights; 
  • governance measures; 
  • compliance with ethical approvals and research protocols. 

The DPIA should demonstrate that only the minimum amount of personal data necessary for the research purposes will be processed. 

Step 5 – Identify privacy risks  #

Identify potential risks to the rights and freedoms of participants throughout the entire data lifecycle. 

Typical risks in biomedical research include: 

  • unauthorised access to personal data; 
  • re-identification of pseudonymised data; 
  • data breaches; 
  • discrimination or stigmatisation; 
  • misuse of genetic information; 
  • international transfers without adequate safeguards; etc. 

Both the likelihood and the severity of each risk should be evaluated. 

Step 6 – Define mitigation measures  #

For each identified risk, specify appropriate technical and organisational measures designed to reduce the risk to an acceptable level. 

Step 7 – Consult relevant stakeholders  #

Where appropriate, consult relevant stakeholders during the DPIA process. 

This may include: 

  • the Data Protection Officer (DPO); 
  • information security personnel; 
  • ethics committees; 
  • researchers; 
  • biobank managers; 
  • patient representatives or participant advisory groups, etc. 

Step 8 – Determine whether residual risks remain high  #

After implementing mitigation measures, assess whether the remaining (residual) risks are still considered high. 

If high residual risks cannot be adequately mitigated, the organisation must consult the competent supervisory authority before commencing the processing, in accordance with Article 36 GDPR (Prior Consultation). 

Step 9 – Document and approve the DPIA  #

The completed DPIA should include: 

  • description of the processing; 
  • assessment of necessity and proportionality; 
  • identified risks; 
  • mitigation measures; 
  • consultation activities; 
  • conclusions; 
  • approval by the appropriate governance bodies. 

Step 10 – Monitor and review  #

A DPIA should be reviewed whenever: 

  • new categories of data are collected; 
  • new technologies are introduced;  
  • international transfers change; 
  • artificial intelligence or automated decision-making is introduced; 
  • security incidents occur. 

A well-conducted DPIA must be intended as an integral component of responsible research governance.  

There is no strict form a DPIA must take; instead, what is appropriate will depend (amongst other things) upon the nature and complexity of the processing, the potential risks posed by the processing, the resources of the employer, and any further guidelines that may be put in place. 

Relevant EU legislation and guidelines   #

  •   Directive on privacy and electronic communications: Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector.  
  • EU Data Governance Act (DGA) – Regulation (EU) 2022/868 : Promotes secure and ethical data sharing across the EU, including health data and introduces data altruism and data intermediaries.  

 DPIA tools and resources   #

Non-commercial resources for general research   #

  • GDPR.eu :GDPR.eu is a resource for organisations and individuals researching the General Data Protection Regulation. Here you’ll find a library of straightforward and up-to-date information to help organisations achieve GDPR compliance.   
  • CNIL 
  • The UK Information Commissioner’s Office offers a clear and practical guidance with case studies relevant to health research and a Template to adopt.   

ISO standards #

These standards are frequently used when performing DPIAs 

Specific to biomedical research   #

  • University of Groningen : This guide serves as support for staff and researchers who already have a general understanding of the General Data Protection Regulation (GDPR). The document starts with a guide on how to compile a DPIA for a research project and offers methodology for human subject research.  
  • Generalitat de Catalunya : A tool and methodology to conduct Data Protection Impact Assessments (DPIA). in the field of healthcare. Available in English, Spanish, and Catalan. It is an agile methodology and tool to conduct DPIAs in research and innovation healthcare projects, based on the model of the Catalan Data Protection Authority. With this initiative, the DPO Office contributes to the standardisation of the methodology and criteria to help the health care entities carry out their tasks.   

data, data protection, ELSI
Updated on 16 July, 2026