--- title: "DPIA | Pitch" description: "Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal." url: https://www.pitch.law/technologies/digital-data-protection-impact-assessment --- [pitch](https://www.pitch.law/) [Technology](https://www.pitch.law/technologies) [Privacy, data & AI](https://www.pitch.law/technology-categories/privacy-data-ai) # DPIA Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal. - By By Bart Lieben, Attorney-at-Law ## What it does A data protection impact assessment (DPIA) is required by Article 35 GDPR when processing is likely to result in a high risk to individuals, in particular for systematic and extensive profiling with significant effects, large-scale processing of special categories of data, and systematic monitoring of a publicly accessible area on a large scale. National supervisory authorities also publish lists of processing operations for which a DPIA is required. Our DPIA function turns the assessment into a working record. It takes you step by step through the content that Article 35(7) prescribes, lets your team and the attorney contribute in one place, and keeps a history of what was decided and why. It does not decide whether a risk is acceptable. That judgement is the attorney's, and the controller's. ## Functions ### Screening: is a DPIA needed? A short questionnaire records the features of the planned processing: the data, the scale, whether it involves profiling, vulnerable individuals, new technology, monitoring or matching of datasets. The result is a recommendation, with the criteria that triggered it, which the attorney confirms. If a DPIA is not needed, the reasoning is stored, since the choice itself should be documented. ### Description of the processing Purposes, data categories, data subjects, recipients, systems, retention and transfers are described in structured fields. Where the processing is already in your [record of processing](https://www.pitch.law/technologies/privacy-register), the description starts from that entry, so that the same facts are not written twice. ### Necessity and proportionality The assessment asks for the lawful basis, whether the same purpose could be reached with less data, how individuals are informed and how their rights are exercised, and what role processors play. Answers are free text with guidance on what the law expects. ### Risk assessment and measures Risks to individuals are listed, each with likelihood, severity and the measures that reduce it, followed by the residual risk. The focus is on harm to people (discrimination, loss of control, financial loss, exposure of sensitive data), not on risk to the company. ### Collaboration with the attorney Client and attorney complete the assessment together in the client portal. The DPO's advice, which Article 35(2) requires you to seek, is recorded in the file, together with whether it was followed and, if not, why. ### Outcome and follow-up The record ends in a conclusion: proceed, proceed with named measures, or consult the authority in advance under Article 36 because a high residual risk remains. Review dates are set, since a DPIA should be revisited when the processing changes. ## What you receive - A completed DPIA as a dated, exportable record, signed off by an attorney. - A list of measures with owners, which your project team can act on. - A recorded decision on prior consultation with the authority, where relevant. - A link between the DPIA and the register entry it concerns. Where an AI system is involved, the DPIA is a useful input for the fundamental rights impact assessment under the AI Act; the overlap is explained in [AI Act meets GDPR](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap), and [recruitment tools](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) are a common example. ### Example walk-through Take a Ghent HR-software start-up planning a module that scores candidate applications. Before development starts, the product lead completes the screening in the portal: profiling, significant effect on individuals, innovative technology. The tool recommends a full DPIA and the attorney confirms. Product and attorney fill in the description, necessity and risk sections together over two sessions. The risk list includes discrimination and opacity; measures include human review of every rejection, explanation to candidates and shorter retention. The DPO's advice is recorded, residual risk is judged acceptable, and the DPIA is signed off with a review date at the next major release. Because the module is also an AI system, the file is carried over to the AI Act assessment. The completed record is also what you show a customer or the authority when asked how a high-risk project was assessed, and it is the starting point when the same processing is changed later. ## Where it is used DPIAs are a standing part of our [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service), typically for new software, monitoring of employees, large customer analytics and tools that profile individuals. They also support [AI Act compliance](https://www.pitch.law/solutions/ai-act-compliance) work. A frequent starting point is a [website technology audit](https://www.pitch.law/academy/website-technology-audits-and-gdpr) that shows more tracking than anyone expected. The assessment document is kept in [our Document Studio](https://www.pitch.law/technologies/contract-studio), which brings it up to date when the processing changes. ## In short - Guided steps following Article 35 GDPR - Client and attorney work in the same record - Risks, measures and residual risk documented - Started early, before a system is built - Signed off by an attorney ## Related solutions - [Solutions](https://www.pitch.law/solutions/dpo-as-a-service) ### [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) - [Solutions](https://www.pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://www.pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://www.pitch.law/solutions/ai-act-compliance) ## Background reading - [Academy](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) - [Academy](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - [Academy](https://www.pitch.law/academy/website-technology-audits-and-gdpr) ### [Website Technology Audits and the GDPR](https://www.pitch.law/academy/website-technology-audits-and-gdpr) [What a website technology audit examines, why privacy notices and actual data flows drift apart, and which legal duties it checks.](https://www.pitch.law/academy/website-technology-audits-and-gdpr) - [Academy](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) ### [AI in HR and Recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the GDPR add to it.](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - [Academy](https://www.pitch.law/academy/ai-act-risk-classification-explained) ### [AI Act Risk Classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) [How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act.](https://www.pitch.law/academy/ai-act-risk-classification-explained) - [Academy](https://www.pitch.law/academy/building-an-ai-governance-framework) ### [Building an AI Governance Framework](https://www.pitch.law/academy/building-an-ai-governance-framework) [What an internal AI governance framework consists of, which legal duties it must carry, and how a mid-sized organisation can build one in proportion to its use of AI.](https://www.pitch.law/academy/building-an-ai-governance-framework) - [Academy](https://www.pitch.law/academy/cookie-compliance-and-consent-management) ### [Cookies and Consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management) [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://www.pitch.law/academy/cookie-compliance-and-consent-management) ## More in Privacy, data & AI - ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) - ### [Data Breach Handling](https://www.pitch.law/technologies/breach-response-workflow) [A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer.](https://www.pitch.law/technologies/breach-response-workflow) - ### [Data Subject Requests](https://www.pitch.law/technologies/dsar-handling) [Requests from individuals are logged in the client portal, tracked against the deadline and fulfilled with a data export and, for erasure, a cascade across linked records.](https://www.pitch.law/technologies/dsar-handling) - ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)