# EU DPIA assessment
> Source: https://legalcode.md/skills/legalcode-eu-dpia-assessment | [HTML version](https://legalcode.md/skills/legalcode-eu-dpia-assessment)

Perform EU Data Protection Impact Assessments (DPIAs) under GDPR Article 35, EDPB Guidelines WP 248 rev.01, EDPB Opinion 28/2024 (AI/ML systems), EDPB…

Perform EU Data Protection Impact Assessments (DPIAs) under GDPR Article 35, EDPB Guidelines WP 248 rev.01, EDPB Opinion 28/2024 (AI/ML systems), EDPB Guidelines 01/2025 (Pseudonymisation), and national supervisory authority (SA) blacklists. Triggers on: "DPIA", "DSFA", "Datenschutz-Folgenabschätzung", "évaluation d'impact", "AIPD", "Data Protection Impact Assessment", "impact assessment", "Art. 35", "Art. 36", "do I need a DPIA", "high-risk processing", profiling, AI systems, biometrics, special categories of data, large-scale monitoring, employee surveillance, connected vehicles, smart cities, genetic data, prior consultation questions, Art. 36 submission preparation, and any vendor or processor involvement in high-risk processing. Covers: threshold assessment (Art. 35(3) mandatory triggers + nine EDPB criteria + multi-jurisdictional national blacklist analysis), systematic description (Art. 35(7)(a)), necessity and proportionality (Art. 35(7)(b)), risk assessment with 5×5 scoring matrix (Art. 35(7)(c)), mitigation measures (Art. 35(7)(d)), residual risk framing, Art. 36 prior consultation threshold and package preparation, DPO involvement (Art. 35(2)), data subject consultation (Art. 35(9)), AI/ML dual-phase DPIA per EDPB Opinion 28/2024, AI Act FRIA interaction, vendor and processor DPIA obligations (Art. 28), and authority-facing documentation standards. EU/EEA-specific with national SA coverage for Germany (DSK), France (CNIL), Netherlands (AP), Ireland (DPC), Belgium (APD), Italy (Garante), and Poland (UODO). Use as the native Legalcode DPIA assessment workflow, replacing any imported DPIA tooling.

This skill produces a complete DPIA assessment package for processing activities that may create high risk to the rights and freedoms of natural persons under GDPR Article 35. **Covers:** - Threshold determination: whether a DPIA is required, recommended, or not needed - Art. 35(3) mandatory trigger analysis (three absolute cases) - Nine-criteria EDPB analysis per WP 248 rev.01 - Multi-jurisdictional national SA blacklist and whitelist checks - Threshold Justification Memo (for negative determinations, Art. 5(2) accountability) - Systematic description of processing (Art. 35(7)(a)) - Necessity and proportionality assessment (Art. 35(7)(b)) - Risk identification and 5×5 scoring from the data subject's perspective (Art. 35(7)(c)) - AI/ML dual-phase analysis per EDPB Opinion 28/2024 - Mitigation measures with pre/post scoring (Art. 35(7)(d)) - Residual risk determination and Art. 36 prior consultation threshold check - DPO involvement documentation (Art. 35(2)) - Vendor and processor DPIA obligations under Art. 28 - AI Act FRIA vs. GDPR DPIA interaction - Authority-facing documentation: full DPIA report, Art. 36 consultation package, executive summary, and threshold memo **Does not:** - Provide legal advice or replace DPO or qualified privacy counsel - Guarantee regulatory approval or SA non-intervention - Substitute for security penetration testing or technical security assessments - Cover ...

## Jurisdictions

European Union



---
*Legalcode -- legalcode.md*