What is the difference between a DPIA and a privacy impact assessment?

A Data Protection Impact Assessment (DPIA) is a legally mandated assessment under GDPR Article 35 required when processing is likely to result in a high risk to individuals' rights and freedoms. A Privacy Impact Assessment (PIA) is a broader, voluntary risk-management exercise used to evaluate privacy risks in any project or system. DPIAs have specific legal requirements including mandatory elements defined in Article 35(7), while PIAs follow flexible frameworks such as ISO 29134 or NIST guidance.

GDPR Compliance Guide

Stop Guessing Whether You Need a DPIA: Get Automated Compliance Guidance in Minutes

Q: When is a DPIA legally required under GDPR?

Under GDPR Article 35, a DPIA is required when processing is likely to result in a high risk to individuals' rights and freedoms. This includes systematic and extensive profiling with significant effects, large-scale processing of special category data, and systematic monitoring of publicly accessible areas. The EDPB has published guidelines with nine criteria to help determine when a DPIA is necessary.

Q: What must a DPIA contain according to GDPR Article 35(7)?

GDPR Article 35(7) requires a DPIA to contain: (a) a systematic description of the processing operations and purposes, including legitimate interest if applicable; (b) an assessment of the necessity and proportionality of the processing; (c) an assessment of the risks to the rights and freedoms of data subjects; and (d) the measures envisaged to address the risks, including safeguards, security measures, and mechanisms to ensure data protection.

Q: How often should a DPIA be reviewed?

GDPR Article 35(11) states that a DPIA shall be reviewed when there is a change in the risk represented by processing operations. The EDPB recommends continuous review, particularly when the processing operation changes, when new technologies are introduced, or when the organizational or societal context changes. Best practice is to reassess at least annually or upon any material change.

Q: What is the penalty for not conducting a required DPIA?

Failure to carry out a required DPIA can result in administrative fines of up to EUR 10 million or 2% of annual global turnover under GDPR Article 83(4)(a). Supervisory authorities have issued fines for DPIA failures; for example, the French CNIL fined a hospital EUR 400,000 in 2021 partly for failing to conduct a DPIA before deploying a patient management system.

Updated 2026-05-17

Key Takeaways: Priverion is a Swiss-hosted platform that automates DPIA and privacy impact assessment workflows across multi-entity organizations under GDPR and FADP.

Get the exact framework to distinguish DPIAs from general privacy assessments, then automate the entire process across every subsidiary.

No credit card required. No spam. Your data stays in Swiss infrastructure.

"We were spending 60% of our compliance admin time chasing business units across subsidiaries for ROPA updates. In six months with Priverion, recertification was fully automated. I finally focus on strategic privacy work instead of maintaining spreadsheets."

DPO, Aircraft manufacturer

Multi-subsidiary aerospace manufacturer, GDPR compliance across group entities

Swiss-hosted ISO 27001 GDPR-compliant infrastructure

Trusted by 50+ privacy teams across 14 countries

Healthcare

Aviation

Energy

Legal

Technology

Why Teams Choose Priverion for DPIAs

Stop Over-Engineering Assessments. Start Running Them Right.

Understanding the difference between a DPIA and a PIA is step one. Operationalizing it across every subsidiary, without spreadsheets, is where most teams get stuck.

AI-Assisted DPIA Drafting

Priverion's AI pre-populates DPIA documentation based on your processing activity descriptions, mapping risks to EDPB criteria and suggesting mitigation measures. You review and approve every output before it becomes a compliance record. AI assists, humans decide.

200+ hours saved in ISO 27001 preparation

Medtec, first 6 months of implementation

Automated Recertification Across Entities

DPIAs are not one-time exercises. Article 35(11) requires ongoing review. Priverion automatically triggers recertification workflows when processing changes, timelines expire, or regulatory guidance updates. No more chasing business units across subsidiaries.

100% ROPA recertification rate, fully automated

AXA, across all group entities

Audit-Ready Evidence in Minutes

When a supervisory authority requests your DPIA documentation, you need complete Article 35(7) packages, not scattered files across shared drives. Priverion generates structured, regulator-ready evidence packages covering processing descriptions, necessity assessments, risk evaluations, and mitigation measures.

60% reduction in compliance admin time

Aircraft manufacturer, first 6 months of implementation

200+

Hours saved on ISO 27001 preparation

Medtec, measured across documentation, evidence gathering, and audit prep in their first compliance cycle with Priverion

60%

Lower cost vs. OneTrust for equivalent privacy program scope

Aircraft manufacturer, based on comparative pricing for multi-entity ROPA, DPIA, and vendor management modules at contract evaluation

3 mo

Ahead of schedule on ISO 27001 certification timeline

Medtec, accelerated through automated evidence collection, pre-mapped controls, and audit-ready documentation packages

Priverion vs. OneTrust

Enterprise-grade privacy management without the enterprise headache

Mid-market companies don't need 200 shallow integrations or a six-figure contract to manage privacy across subsidiaries. Here's why teams like Aircraft manufacturer and Zurzach Care chose Priverion.

"We evaluated OneTrust and two other platforms. Priverion gave us everything we needed for group-wide ROPA management at a fraction of the cost, and we were operational in weeks, not months."

DPO, Aircraft manufacturer

60% reduction in compliance admin time within 6 months

The typical enterprise platform

Per-user, per-module pricing Costs balloon as you add subsidiaries, users, or modules. Budget surprises every renewal cycle.
US-headquartered, US-hosted Subject to CLOUD Act and FISA 702. Post-Schrems II, cross-border data transfers face ongoing legal uncertainty.
200+ integrations, most shallow Impressive on a feature comparison sheet. In practice: maintenance overhead, broken connectors, and data that doesn't actually flow where you need it.
6-12 month implementation Dedicated implementation teams, professional services fees, and months before anyone logs in productively.
Built for the Fortune 500 Feature-rich but complex. Mid-market teams end up paying for ESG modules, ethics hotlines, and cookie consent tools they'll never configure.

Priverion

Predictable pricing by company size Based on number of entities and organizational size, not per-user or per-module. No expansion traps. Scale your group without scaling your invoice.
Swiss-built, Swiss-hosted All data processed within Swiss infrastructure. European data residency by design. In a post-Schrems II world, this isn't a marketing checkbox; it's a legal advantage.
Deep integrations where it matters HR, procurement, IT asset management: the systems that actually drive privacy workflows. Fewer connectors, better data flow, less maintenance.
Operational in weeks, not months Aircraft manufacturer achieved 60% reduction in compliance admin time within their first 6 months. AXA reached 100% ROPA recertification, fully automated. Based on customer-reported outcomes, 2023-2024
Built for multi-entity mid-market ROPA, DPIA, vendor assessments, DSRs, incident management, and AI Act readiness, all in one platform. No modules you'll never use. No features you'll never configure.

Stop managing privacy across spreadsheets. Start managing it from one platform.

See how Priverion gives multi-entity organizations group-wide visibility, automated recertification, and audit-ready evidence, all hosted in Switzerland.

"We went from chasing business units across subsidiaries for ROPA updates to fully automated recertification. Our DPO now focuses on strategic privacy work instead of spreadsheet maintenance."

Aircraft manufacturer, 60% reduction in compliance admin time within 6 months

Weeks

Time to go live, not months

50+

Entities managed on one platform

100%

Swiss data residency

Start My Free DPIA Assessment

No commitment. No sales deck. Just a live walkthrough tailored to your group structure.

▸ About this page — references, definitions, and FAQs

Key Takeaways

A Data Protection Impact Assessment (DPIA) is a legally mandated process under GDPR Article 35, required whenever data processing is likely to result in a high risk to individuals' rights and freedoms. A Privacy Impact Assessment (PIA) is a broader, voluntary risk-management tool used to evaluate privacy implications of any project. Understanding when each applies — and automating the workflow across subsidiaries — is critical for multi-entity compliance programs operating under GDPR, the Swiss FADP, and ISO 27001.

What is a DPIA?

A Data Protection Impact Assessment (DPIA) is a structured process mandated by GDPR Article 35 that requires data controllers to assess the impact of processing operations on the protection of personal data. It must be carried out before processing begins when the activity is "likely to result in a high risk to the rights and freedoms of natural persons." The EDPB Guidelines on DPIAs (WP248 rev.01) identify nine criteria for determining when a DPIA is required, including evaluation or scoring, automated decision-making with legal effects, systematic monitoring, and large-scale processing of sensitive data.

What is a Privacy Impact Assessment (PIA)?

A Privacy Impact Assessment (PIA) is a broader risk-management methodology that evaluates how a project, system, or process collects, uses, shares, and protects personal information. Unlike a DPIA, a PIA is not mandated by a single regulation but is recommended by frameworks such as ISO/IEC 29134:2023 (Guidelines for privacy impact assessment) and NIST SP 800-122. PIAs are commonly used in jurisdictions without GDPR-equivalent DPIA requirements and as an early-stage screening tool to determine whether a full DPIA is needed.

DPIA vs PIA: Comparison Table

Criterion	DPIA (GDPR Article 35)	PIA (General Practice)
Legal basis	Mandatory under GDPR Art. 35; Swiss FADP Art. 22	Voluntary; recommended by ISO 29134, NIST
Trigger	High risk to rights and freedoms of data subjects	Any new project, system, or process involving personal data
Mandatory elements	Four elements defined in Art. 35(7): description, necessity, risk assessment, mitigation	Flexible; varies by framework
Supervisory authority consultation	Required if residual high risk remains (Art. 36)	Not required
Penalties for non-compliance	Up to EUR 10 million or 2% global turnover (Art. 83(4)(a))	None (voluntary)
Review requirement	Ongoing review required (Art. 35(11))	Best practice; not legally mandated
Scope	Specific processing operations	Broader project or system scope

When is a DPIA legally required under GDPR?

GDPR Article 35(3) lists three scenarios where a DPIA is always required: (a) systematic and extensive evaluation of personal aspects based on automated processing, including profiling, that produces legal effects; (b) large-scale processing of special categories of data under Article 9(1) or criminal conviction data under Article 10; and (c) systematic monitoring of a publicly accessible area on a large scale. Beyond these, the EDPB's nine criteria provide further guidance — if a processing activity meets two or more criteria, a DPIA is generally required.

What must a DPIA contain according to GDPR Article 35(7)?

According to GDPR Article 35(7), a DPIA must contain at minimum: (a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller; (b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes; (c) an assessment of the risks to the rights and freedoms of data subjects; and (d) the measures envisaged to address the risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data.

Does the Swiss FADP require DPIAs?

Yes. The revised Swiss Federal Act on Data Protection (FADP), which entered into force on September 1, 2023, requires a Data Protection Impact Assessment under Article 22 when processing is likely to result in a high risk to the personality or fundamental rights of data subjects. If the assessment shows that the planned processing still entails a high risk despite the measures taken, the controller must consult the Federal Data Protection and Information Commissioner (FDPIC) before proceeding.

How often should a DPIA be reviewed?

GDPR Article 35(11) requires that controllers carry out a review of the DPIA "at least when there is a change in the risk represented by processing operations." The EDPB recommends continuous review, particularly when the nature, scope, context, or purposes of processing change, when new technologies are introduced, or when the organizational or societal context evolves. According to the IAPP-EY 2023 Privacy Governance Report, 68% of organizations with mature privacy programs review DPIAs at least annually.

What is the penalty for not conducting a required DPIA?

Under GDPR Article 83(4)(a), failure to carry out a required DPIA can result in administrative fines of up to EUR 10 million or 2% of the undertaking's total annual worldwide turnover, whichever is higher. Supervisory authorities across Europe have enforced this provision. According to EDPB enforcement data, DPIA-related violations have been cited in multiple enforcement actions since 2018.

Statistics and Industry Context

According to the IAPP-EY 2023 Privacy Governance Report, the average organization now employs 5.2 full-time privacy staff, up from 3.7 in 2020, reflecting growing regulatory complexity. The same report found that 59% of organizations conduct DPIAs for all high-risk processing activities. A Gartner forecast projects that by 2025, 75% of the world's population will have personal data covered under modern privacy regulations, making structured impact assessments increasingly critical. The ENISA Data Protection Engineering report emphasizes that DPIAs should be integrated into the system development lifecycle rather than treated as a one-time compliance checkbox.

Your trusted partner for a smarter, more efficient approach to data privacy management.

Product

Priverion Platform System Status

about us

About Priverion Careers

Imprint Privacy Notice Terms of Service Refund Policy

OneTrust, TrustArc, Drata, Vanta, BigID, DataGuard, Kertos, Securiti and Sprinto are trademarks of their respective owners. Priverion Solutions AG is an independent Swiss company and is not affiliated with, sponsored by, or endorsed by any of these companies. References to these products are made under the fair-use exception for comparative advertising (Swiss UWG Arts. 3(1)(a)(b)(e); EU Directive 2006/114/EC Art. 4) for the sole purpose of informing prospective customers. Methodology and sources for comparative claims are disclosed on each page that contains them; see also our comparative advertising policy. To challenge a specific claim, write to [email protected].