GDPR: risk assessment and DPIA
GDPR requires risk-based security (Art. 32) and Data Protection Impact Assessment (DPIA, Art. 35) for high risk. Here's when a DPIA is mandatory, what to include, and how RiskNote helps you structure the risk part.
What does GDPR require in terms of risk management?
GDPR is risk-based throughout. The controller must implement technical and organisational measures that are “appropriate in relation to the risk” (Art. 32). That means you need a risk assessment, formal or informal.
For particularly high-risk processing a DPIA (Data Protection Impact Assessment, Art. 35) is required. Supervisory authorities (in Sweden: IMY) publish lists of when a DPIA is always required, plus threshold criteria for other cases.
GDPR risk assessment is compatible with ISO 31000, same identify → analyse → evaluate → treat → monitor.
When is a DPIA required?
Automated decision-making with legal effects
E.g. automated credit scoring, AI-based decision-making (GDPR Art. 22).
Large-scale systematic monitoring
Video surveillance of public spaces, large-scale behavioural tracking.
Large-scale processing of special-category data
Health, ethnicity, religion, sexuality, union membership (Art. 9 data).
Dataset matching
Combining or comparing datasets from different sources.
Vulnerable data subjects
Employees (in the employment context), children, patients, customers in dependent relationships.
New technology
AI processing, biometrics, IoT devices, especially when unproven.
DPIA checklist (Art. 35.7)
Systematic description of processing
Purpose, scope, types of data, categories of data subjects, recipients, retention.
Necessity and proportionality
Can the purpose be achieved with less privacy intrusion? Is the processing proportionate?
Risk assessment
Identify risks to the rights and freedoms of data subjects. Assess likelihood and consequence. The RiskNote part.
Measures to address the risks
Technical (encryption, pseudonymisation) and organisational (access control, training) measures.
Consultation with DPO
If a DPO exists, their assessment must be documented.
Consultation with data subjects or representatives
Where appropriate, e.g. employee representatives for HR processing.
Prior consultation with supervisory authority
If risks can't be reduced to an acceptable level, consultation is required before processing begins.
How RiskNote supports GDPR risk assessment
RiskNote fits very well for the **risk-assessment part** of a DPIA (Art. 35.7(c)). The AI can suggest typical risks for personal data processing: unauthorised access, dissemination, purpose drift, insufficient transparency, right to erasure.
RiskNote does not cover the **full DPIA process** (description of processing, proportionality assessment, DPO consultation). A full DPIA template is planned as a free tool Q3 2026.
**EU AI Act**: if your processing involves AI, the EU AI Act (from 2026) requires additional transparency. RiskNote is itself EU AI Act-compliant and labels all AI output per Art. 50.
Frequently asked questions about GDPR risk analysis
Is a formal risk assessment required even without a DPIA?
GDPR Art. 32 requires security measures to be “appropriate in relation to the risk”. That implies a risk assessment even without a formal DPIA. Most organisations should have a general GDPR risk register for all processing, plus a DPIA for high-risk processing.
Can we do the whole DPIA in RiskNote?
The risk-assessment part, yes, excellently. The full DPIA documentation (description, proportionality, consultation) requires a separate template or DPIA tool. We're planning a free DPIA template Q3 2026 that complements the RiskNote register.
Does the supervisory authority need to approve our DPIA?
No, the DPIA is your own document. Prior consultation with the supervisory authority is only required if the risks can't be reduced to an acceptable level (Art. 36).
How long should we keep DPIAs?
For as long as the processing continues plus at least the limitation period (usually 5–10 years). Update the DPIA on material change to the processing.
Can a DPO replace the need for a DPIA?
No, the DPO is an organisational requirement (Art. 37), the DPIA is a process requirement (Art. 35). Both can be required at the same time. The DPO reviews the DPIA process.
Structure your GDPR risk management today
Start a free trial. First GDPR risk register ready in under an hour.