High-risk processing documented with DPIA; mitigation strategies tracked

GDPR Art. 35 mandates a Data Protection Impact Assessment before commencing high-risk processing — this is not a retrospective exercise. High-risk processing categories include systematic user profiling, automated decision-making with legal effects, large-scale processing of special category data (health, biometrics, religion), and behavioral scoring. AI-built apps are especially prone to inadvertent DPIA triggers: recommendation engines, usage-based pricing tiers, and sentiment analysis of user content can all qualify. ISO-27001:2022 A.5.34 requires organizations to assess privacy risks before implementing new processing. Proceeding with high-risk processing without a DPIA is an Art. 35 violation even if no harm occurs.

Identify whether any current or planned features trigger GDPR Art. 35 (profiling, automated decisions, special category data at scale). For each that does, document a DPIA before enabling the feature in production.

# DPIA: [Processing Activity] — e.g., "Behavioral Profiling for Feature Recommendations"

## 1. Description of Processing
What data, purpose, means, duration.

## 2. Necessity and Proportionality
Why necessary? Less privacy-invasive alternative considered?

## 3. Risks to Data Subjects
| Risk                    | Likelihood | Impact | Level  |
|-------------------------|------------|--------|--------|
| Inaccurate profiling    | Medium     | High   | High   |
| Behavior data breach    | Low        | High   | Medium |

## 4. Mitigations
| Risk                 | Mitigation                                | Owner | Status |
|----------------------|-------------------------------------------|-------|--------|
| Inaccurate profiling | Human review available; opt-out mechanism | PM    | Done   |

## 5. Residual Risk
If High residual risk: consult supervisory authority before proceeding (GDPR Art. 36).

Store DPIAs in docs/dpia/ alongside your other compliance documentation and review them when the processing purpose or scope changes.