Data Protection Impact Assessments (DPIA): Tools and resources

Table Of Contents

Browse our selection of Data Protection Impact Assessment (DPIA) tools and resources and find out how to conduct Data Protection Impact Assessments  

Overview #

Data Protection Impact Assessment (DPIA) is a systematic process used to identify and minimise the data protection risks of a project, especially when personal or sensitive data is processed.  

Under the General Data Protection Regulation (GDPR), art. 35, a DPIA is mandatory when a type of data processing is likely to result in a high risk to the rights and freedoms of individuals — which is very often the case in health and biomedical research, and especially in biobanking. Such ‘high risk’ occurs when there is systematic monitoring of individuals (e.g., genetic profiling), a special category of data at stake (e.g., health/genetic/biometric) is processed on a large scale, new technologies or AI are used, there’s automated decision-making with significant effects. Indeed, DPIA is of utmost importance in the areas of health, biomedical research, and biobanking, giving that these fields often involve:  

  • Sensitive data: Genetic, biometric, health, and lifestyle data  
  • Large-scale processing: Long-term storage and secondary uses in research  
  • Vulnerable data subjects: Including minors, elderly, or rare disease patients  
  • Innovative technologies: AI, genomic sequencing, data linkage, cloud sharing  

The Data Protection Working Party WP29 identified nine criteria that should consider evaluating if a process is likely to result in a high risk for the rights and the freedom of the data subject. For European research projects, the criteria are specified in the guidance for the ethics self-assessment. The DPIA process aims to ensure that controllers adequately address privacy and data protection risks of ‘risky’ processing operations. By providing a structured way of thinking about the risks to data subjects and how to mitigate them, DPIAs help organisations to comply with the requirement of ‘data protection by design’.    

DPIAs help ensure:  

  • Ethical compliance and trustworthiness  
  • Legal compliance with GDPR  
  • Transparency and accountability  
  • Protection against data breaches and misuse 

A DPIA is not just a bureaucratic step, but a tool for:  

  • Fostering data ethics and public trust  
  • Ensuring participant autonomy  
  • Enabling responsible innovation in science  

The DPIA process aims to ensure that controllers adequately address privacy and data protection risks of ‘risky’ processing operations. By providing a structured way of thinking about the risks to data subjects and how to mitigate them, DPIAs help organisations to comply with the requirement of ‘data protection by design’.    

Key ethical, legal and societal implications #

Informed Consent and Autonomy  #

When conducting a DPIA it is crucial to question whether collected consent is truly informed, specific, and freely given, especially for secondary use of data and samples. The DPIA should assess whether participants are made aware of how and why their data is used, and whether they can withdraw.  

Proportionality and Necessity  #

When conducting a DPIA it is crucial to assess whether the data collection and data processing is proportionate to the research aims, and whether less intrusive alternatives be used.  

Data Minimisation and Storage Duration  #

When conducting a DPIA it is crucial to assess whether only the minimum necessary data has been collected, how long data and samples will be stored  

Legal Basis, Data Subjects’ Rights, Safeguards  #

It is important to verify what legal allowance (legal basis) have been adopted for data collection and processing, as well as whether data subjects’ rights (e.g. access, rectification, erasure, objection) have been respected and operationalised, and what robust technical and organisational measures (e.g., pseudonymisation, encryption, role-based access) are in place for protecting personal and sensitive data.   

Data Transfers  #

The DPIA should address legal safeguards for transfers outside the EU (e.g., standard contractual clauses, adequacy decisions).  

Use of Artificial Intelligence / Automated Processing  #

If Artificial Intelligence or Machine Learning is used to analyse data, the DPIA should address the potential risks of discrimination, opacity, or profiling.  

Relevant EU legislation or guidelines #

General Data Protection Regulation (GDPR)  

The GDPR provides a regulatory framework for lawfully processing personal data, including genetic data and any other health information.     

Art. 29 Working Party, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679 (WP248rev.01)  

Adopted on 4 April 2017 , the Data Protection Working Party identified nine criteria that should consider evaluating if a process is likely to result in a high risk for the rights and the freedom of the data subject.   

EU Grants - How to complete your ethics self-assessment, Version 2.0, 13 July 2021  

For European research projects, the criteria to evaluate when considering if conducting a DPIA are specified in the guidance for the ethics self-assessment.  

Directive on privacy and electronic communications

Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector.  

EU Data Governance Act (DGA) – Regulation (EU) 2022/868  

  • Promotes secure and ethical data sharing across the EU, including health data.  
  • Introduces data altruism and data intermediaries.  

EU Data Act (Regulation (EU) 2023/2854)  

Governs access to and reuse of non-personal and some personal data; supports innovation through data sharing.  

External resources #

 Non-commercial resources for general research   #

  • GDPR.eu   – GDPR.eu is a resource for organisations and individuals researching the General Data Protection Regulation. Here you’ll find a library of straightforward and up-to-date information to help organisations achieve GDPR compliance.   Link to the DPIA template
  • CNIL   – Here you can find the link to download the software.  
  • UK ICO DPIA Guidance   – The UK Information Commissioner’s Office offers a clear and practical guidance with case studies relevant to health research.   

Specific to biomedical research   #

  • University of Groningen   – This guide serves as support for staff and researchers who already have a general understanding of the General Data Protection Regulation (GDPR). The document starts with a guide on how to compile a DPIA for a research project and offers methodology for human subject research.  
  • Generalitat de Catalunya   – A tool and methodology to conduct Data Protection Impact Assessments (DPIA). in the field of healthcare. Available in English, Spanish, and Catalan. It is an agile methodology and tool to conduct DPIAs in research and innovation healthcare projects, based on the model of the Catalan Data Protection Authority. With this initiative, the DPO Office contributes to the standardisation of the methodology and criteria to help the health care entities carry out their tasks.   

Relevant literature #

data, data protection, ELSI, ethics
Updated on 14 July, 2026