DPIA conducted for high-risk processing activities per Art. 35

GDPR Art. 35 mandates a Data Protection Impact Assessment before carrying out high-risk processing — systematic profiling with significant effects, large-scale processing of special category data (health, biometrics, racial origin), automated decision-making with legal consequences, or large-scale monitoring. A recommendation engine, credit scoring algorithm, or health data platform that launches without a DPIA is not just non-compliant — it may be subject to a mandatory consultation with the supervisory authority under Art. 36 before processing can begin. Most SaaS products do not trigger Art. 35, but failing to document that assessment explicitly leaves you unable to demonstrate the exemption.

Assess whether your application triggers any Art. 35 threshold, document the conclusion, and complete a DPIA if required. A concise DPIA stored in docs/dpia.md is legally valid.

# DPIA Assessment (Art. 35 GDPR)

Date: 2026-02-22

- Systematic profiling with significant effects: No
- Large-scale special category data: No
- Systematic monitoring of public spaces: No
- Automated decisions with legal/financial effects: No

Conclusion: No Art. 35 trigger. DPIA not mandatory.

If a trigger applies, document the processing description, necessity and proportionality assessment, risks to data subjects, and mitigations. Reference the ICO's DPIA template (ico.org.uk) or the EDPB guidelines on DPIAs (wp248rev.01) as starting points. Store the completed DPIA in docs/dpia-[processing-activity].md and review it whenever the processing materially changes.