# GDPR Article 35: Data Protection Impact Assessment

- Source: https://support.icompaas.com/support/solutions/articles/62000236380-gdpr-article-35-data-protection-impact-assessment
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GDPR](https://support.icompaas.com/support/solutions/62000112722) › [Chapter IV: Controller and Processor](https://support.icompaas.com/support/solutions/folders/gdpr-chapter-4-controller-and-processor)
- Last updated: 2026-07-11
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Overview**

This article requires controllers to conduct a Data Protection Impact Assessment (DPIA) for processing activities that are likely to result in a high risk to the rights and freedoms of data subjects. DPIAs are particularly required for new technologies, profiling, processing of special categories of data, or large-scale monitoring. The assessment must document operations, purposes, risks, and mitigation measures, and involve consultation with the Data Protection Officer (DPO) and, where appropriate, the data subjects.

  

### **Key Principles**

-   Risk Assessment: Identify and evaluate risks to data subjects’ rights and freedoms.
    
-   High-Risk Processing: DPIAs are mandatory for processing involving new technologies, profiling, special categories of data, or large-scale monitoring.
    
-   Mitigation Measures: Implement strategies to reduce identified risks.
    
-   Consultation: Engage the DPO and, when relevant, data subjects in the assessment process.
    
-   Accountability: DPIAs serve as documentation of compliance and risk management.  
      
    

### **Organizational Applicability**

This article applies to all organizations acting as controllers within the EU:

-   Entities conducting high-risk processing activities involving personal data of EU/EEA residents.
    
-   Public and private sector organizations deploying new technologies, analytics, or monitoring systems.
    
-   Teams responsible for compliance, risk management, IT, and data governance.  
      
    

### **Implementation Requirements**

-   Conduct a DPIA before initiating high-risk processing activities.
    
-   Document processing operations, purposes, risks, and mitigation measures.
    
-   Consult with the Data Protection Officer (DPO) and, where appropriate, data subjects.
    
-   Maintain DPIA records to demonstrate accountability and compliance with GDPR.  
      
    

### **Implementation Guidance**

-   Use standard DPIA templates to ensure consistency and completeness.
    
-   Identify potential risks such as data breaches, unauthorized access, or profiling impacts.
    
-   Implement technical and organizational measures to mitigate risks.
    
-   Review and update DPIAs periodically or when processing activities change.  
      
    

### **Periodic Review**

-   Frequency: Prior to initiating high-risk processing and when processing activities or risks change.
    
-   Responsible Role: Data Protection Officer (DPO) or Compliance Team.
    
-   Outcome: Ensure that high-risk processing is assessed, mitigated, and documented to maintain GDPR compliance.  
      
    

### **Non-Compliance Risks**

-   Fines: Up to €20 million or 4% of global annual turnover.
    
-   Legal Exposure: Enforcement actions or invalidation of processing without DPIA.
    
-   Reputational Damage: Loss of trust due to failure to manage risks.
    
-   Operational Risk: Unassessed high-risk processing may lead to breaches, legal challenges, or regulatory scrutiny.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): How the Regulation fits together as a programme — lawful bases, Article 28/30/32/33 obligations, transfers and the DPIA process.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If you also serve users in India, the DPDP Act borrows GDPR concepts but differs on consent, breach reporting and transfers.