Is a data protection impact assessment (DPIA) required?
By Advisorn · updated on 17 October 2026 · Art. 22-23 FADP, Art. 35-36 GDPR
In short
Yes, but only when a processing may result in a high risk to the personality or fundamental rights of the people concerned (Art. 22 FADP): for example with new technologies, with sensitive personal data on a large scale or with the systematic monitoring of extensive public areas. If the risk remains high even after the measures, the FDPIC must be consulted (Art. 23 FADP).
What it contains
- a description of the planned processing;
- an assessment of the risks to the data subjects;
- the measures to protect their personality and fundamental rights.
When it is not needed
It is not needed for processing required by a legal obligation, nor when the business uses a certified system, product or service or complies with a code of conduct that meets the conditions of the law (Art. 22 para. 4 and 5 FADP). Even when no DPIA is needed, it is worth writing down why.
Related questions
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.