Since 25 May 2018, Article 35 of the GDPR has required a data protection impact assessment (DPIA) before any processing likely to result in a high risk to people's rights and freedoms. Three cases always need one, and national lists add more.
This guide is for privacy, compliance and DPO staff in GCC companies whose processing reaches people in the EU.
When is a DPIA mandatory under Article 35?
Article 35(1) of Regulation (EU) 2016/679 sets the rule. You assess before you process, wherever processing is likely to be high risk given its nature, scope, context and purposes.
Article 35(3) names three cases that always need a DPIA. They are systematic, extensive automated evaluation of people, including profiling, that drives decisions with legal or similarly significant effects, large-scale special-category or criminal-offence data, and large-scale systematic monitoring of a publicly accessible area. Each supervisory authority also publishes a list of processing that needs one (Article 35(4)).
Beyond that, the reference is the WP29 Guidelines on DPIA, WP248 rev.01, which the EDPB endorsed on 25 May 2018. They set nine criteria: (1) evaluation or scoring, (2) automated decisions with significant effect, (3) systematic monitoring, (4) sensitive data and (5) large scale. The rest are (6) combining datasets, (7) vulnerable people, (8) innovative technology and (9) processing that blocks a right or service.
Some pages call a DPIA compulsory once two criteria are met. WP248 says that in most cases a controller can consider two criteria enough, and that in some cases one will do. That is a rule of thumb, not a legal test. If you meet criteria and still decide against a DPIA, record why and what your DPO said.
| Processing by a Gulf company | WP248 criteria met | DPIA? | Source |
|---|---|---|---|
| Hotel or retail CCTV with analytics or face recognition | 3, 4, 8 | Likely. Yes if large-scale in a publicly accessible area | CNIL list (biometrics). Art. 35(3)(c) |
| Monitoring the workstations and internet use of staff working in the EU | 3, 7 | Likely | WP248 example. EDPB Opinion 5/2018 |
| Credit, BNPL or fraud scoring of customers in the EU | 1, 2, 9 | Likely | WP248 credit-rating and fraud example |
| Health app or telemedicine for users in the EU | 4, 5, 7 | Likely | WP248 hospital example |
| Location-based app | Location plus at least one other | Likely | EDPB Opinion 5/2018. CNIL list (large-scale location) |
| AI screening of job applicants | 1, 2, 8 | Likely | CNIL list (HR profiling) |
| Shop adverts with limited profiling on its own site | 1 | Not likely | WP248 example |
An AI impact assessment under ISO/IEC 42001 is a different instrument and does not replace the DPIA.
Which national list applies if you have no EU office?
A Gulf company caught by Article 3(2) has the same Article 35 duty as an EU company for that processing. Without an EU establishment you have no one-stop shop and no lead authority. That matters because national lists differ.
On 25 September 2018 the EDPB gave opinions on the draft lists of 22 authorities. It did not aim at a single EU list, but it fixed common positions. Every list is non-exhaustive, and biometric, genetic and location data each need a DPIA when combined with at least one other criterion.
The French list, CNIL Deliberation No. 2018-327 of 11 October 2018, has 14 types. They include recruitment algorithms, constant employee monitoring and large-scale location data. Some authorities also list processing that needs no DPIA (Article 35(5)), and the EDPB has reviewed draft lists of this kind from France and Latvia.
Check the list of each authority whose residents you target or monitor, and keep one screening record per authority.
How do you run a DPIA, and when must you consult the authority?
Start before processing, early in design. Article 35(7) sets four minimum elements:
- a systematic description of the processing and its purposes
- an assessment of necessity and proportionality
- an assessment of the risks to people's rights and freedoms
- the measures and safeguards that address those risks
The method is yours, but WP248 Annex 2 lists criteria for an acceptable DPIA. Seek your DPO's advice (Article 35(2)) and, where appropriate, the views of the people affected (Article 35(9)). Processors must assist under their Article 28 contract.
Review the DPIA at least when the risk changes (Article 35(11)). Existing high-risk processing needs a DPIA when new purposes, data, recipients or retention change its risks.
If the DPIA shows high risk that your measures cannot bring down, Article 36 requires you to consult the supervisory authority before processing. Where it considers the processing would infringe the GDPR, it advises in writing within eight weeks. Complex cases can add six more.
The consultation pack covers roles of controllers and processors, purposes and means, safeguards, DPO contact details and the DPIA itself (Article 36(3)). Silence from the authority does not stop it acting later (Recital 94).
What is the EDPB template, and what else is changing?
On 14 April 2026 the EDPB published a draft DPIA template (version 1.0) for public consultation. Feedback closed on 9 June 2026. It is still a draft, and using it is voluntary. Once it is final, authorities will start steps to adopt it as their single template or as a meta-template.
Its explainer sets seven sections, from overview to a conclusion that picks one outcome: abandon, consult the authority, proceed, or proceed with conditions. Risk is typically rated as likelihood times severity, and very high severity can make a risk unacceptable even when likelihood is low.
A bigger change is proposed, not in force. The Digital Omnibus, COM(2025) 837, would replace national lists with a single EU list of processing that needs a DPIA. It would add a mandatory list of processing that does not, plus a common template and methodology. In October 2026 its European Parliament status was "awaiting committee decision", so national lists still apply.
How do Saudi and UAE impact assessments compare?
Saudi PDPL Article 22 requires an impact assessment for products and services, as the Implementing Regulation sets out. Its Article 25 requires a written one for sensitive data, for linking datasets from different sources and for products likely to cause serious harm to privacy. It also covers large-scale, repetitive processing involving constant monitoring, new technologies, automated decisions or people lacking full legal capacity.
UAE Federal Decree-Law 45 of 2021, Article 21, requires an assessment before using modern technologies that pose a high risk to privacy. It names profiling with legal or serious effect and a large volume of sensitive data. The UAE Data Office is to publish a list of processing that needs no assessment.
All three laws ask for a description, necessity, risks and measures. The Saudi and UAE articles read for this guide contain no equivalent of Article 36. One assessment can serve all three if you check each law's triggers and contents. Our guide to Saudi PDPL enforcement covers the Saudi side.
What will an authority ask to see?
Authorities and EU clients ask for records:
- The screening against Article 35(3), the national lists and the nine criteria.
- A DPIA dated and approved before go-live, with all four Article 35(7) elements.
- The DPO's advice and management's response.
- The views of the people affected, or the reason they were not sought.
- Where residual risk stayed high, the Article 36 pack and correspondence log.
- Review triggers and review records since launch.
In a case published on 7 May 2025, the Polish authority fined Toyota Bank Polska EUR 132,000. Of that, EUR 72,000 was for Articles 30(1) and 35(1) and (7), because credit-scoring profiling was neither recorded nor assessed. On 12 June 2025 the Irish DPC fined the Department of Social Protection EUR 550,000 over facial matching. Its DPIA left out details that Article 35(7)(b) and (c) require on necessity and on risks.
Two cases are not a trend. They show that a missing DPIA and an incomplete one are both infringements. Failing to run a required DPIA, running one wrongly or failing to consult all sit in the tier of up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher (Article 83(4)(a)). Pages quoting EUR 20 million or 4% cite the wrong tier.
How AGS can help
The EU GDPR Data Protection Impact Assessment (DPIA) Management System holds 271 editable Microsoft Word and Excel documents. It includes a WP248 Criteria Assessment, a Supervisory Authority DPIA List Checklist, a Necessity and Proportionality Assessment, a Privacy Risk Register and an Article 36 Decision Tool. It also has 20 scenario annexes, 6 completed fictional examples and a GDPR Article-to-Document-to-Evidence Matrix. It does not supply national lists or cover Saudi or UAE law.
Frequently asked questions
Is a DPIA the same as a PIA?
For GDPR purposes, in practice yes. The GDPR's term is "data protection impact assessment", but the CNIL calls its free DPIA method, templates and open-source software "PIA".
Do we have to publish our DPIA?
No. WP248 encourages publishing a summary, especially where the public is affected. The full DPIA goes to the authority in prior consultation or on request.
Can we outsource the DPIA?
Someone inside or outside your organisation can carry it out. You remain accountable as controller, and the DPIA should record the DPO's advice and your decisions.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by the European Data Protection Board, the European Commission, any EU supervisory authority, SDAIA or the UAE Data Office. It is general information, not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
