{"answer_id":"praxikon:eu:gdpr:answer:dpia-plicht","canonical_page":"https://www.praxikon.com/en/antwoord/avg/dpia-plicht","query":"Is a DPIA required?","lang":"en","view":"full","mode":"gdpr","regime":"gdpr","topic":"dpia-plicht","question":"Is a DPIA required?","label":"When a DPIA is required","answer":"A DPIA is required where processing is likely to result in a high risk to the rights and freedoms of natural persons (Article 35(1)). That is in any case so for (Article 35(3)): (a) a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significant effects; (b) processing on a large scale of special categories of data or of data relating to criminal convictions and offences; (c) systematic monitoring of a publicly accessible area on a large scale. In addition, the list of the Dutch Data Protection Authority (Staatscourant 2019, 64418) includes, among others: employee monitoring, fraud prevention, profiling, credit scoring, camera surveillance, location data and biometric data. According to the EDPB guidelines, a DPIA is as a rule required where two or more of the nine criteria are met (such as evaluation or scoring, systematic monitoring, vulnerable data subjects such as employees, and innovative technology).","applied_to_question":null,"matched_terms":[],"articles":[{"article":35,"source_locator":"Art. 35(1) GDPR","point":"Main rule: likely high risk.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/35"},{"article":35,"source_locator":"Art. 35(3)(a) to (c) GDPR","point":"Three cases in which a DPIA is required in any event, including profiling with decisions.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/35"},{"article":35,"source_locator":"Art. 35(4) GDPR","point":"The supervisory authority establishes a list of processing operations that require a DPIA.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/35"}],"case_law":[],"guidance":[{"id":"wp29-wp248","kind":"guidance","title":"Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is \"likely to result in a high risk\" for the purposes of Regulation 2016/679","issuer":"Article 29 Working Party","reference":"WP248 rev.01","ecli":null,"date":"2017-10-04","status":"final","point":"Nine criteria; where two or more are met, a DPIA is as a rule required. Employees count as vulnerable data subjects.","source_url":"https://ec.europa.eu/newsroom/article29/items/611236","human_page":null},{"id":"wp29-wp249","kind":"guidance","title":"Opinion 2/2017 on data processing at work","issuer":"Article 29 Working Party","reference":"WP249 (Opinion 2/2017)","ecli":null,"date":"2017-06-08","status":"final","point":"Data processing at work: monitoring of employees.","source_url":"https://ec.europa.eu/newsroom/article29/items/610169","human_page":null},{"id":"gdpr-guidelines-ap-dpia-lijst","kind":"guidance","title":"Decision on the list of processing operations for which a DPIA is mandatory (Dutch DPA)","issuer":"Autoriteit Persoonsgegevens (AP)","reference":"Staatscourant 2019, nr. 64418","ecli":null,"date":"2019-11-27","status":"in_force","point":"Dutch list of 17 types of processing, including employee monitoring, fraud prevention and profiling.","source_url":"https://www.autoriteitpersoonsgegevens.nl/documenten/lijst-verplichte-dpia","human_page":"https://www.praxikon.com/en/avg/richtsnoeren/ap-dpia-lijst"}],"enforcement":[],"open_questions":["Is the processing large-scale or systematic (the Dutch list sets its own condition per category)?","Are decisions about people based on it?"],"human_page":"https://www.praxikon.com/en/avg/artikel/35","dataset":{"id":"praxikon-gdpr","source":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","known_at":"2026-09-15"},"casus_check":"https://www.praxikon.com/en/casus-check","disclaimer":"General interpretation, not legal advice. The official source remains authoritative.","methodology":"https://www.praxikon.com/en/methodologie"}