What a Data Protection Impact Assessment Is and What It Does
The Data Protection Impact Assessment is the GDPR's central instrument for systematically evaluating and mitigating the risks of a processing operation before it starts (DSK Kurzpapier Nr. 5). It is not a one-time form but a documented process: the controller describes the planned processing, checks its necessity, evaluates the risks to the affected individuals, and defines mitigation measures. The goal is not bureaucracy for its own sake but demonstrable data protection — the DPIA is accountability in action under Art. 5(2) GDPR.
In the web context, this primarily concerns analytics, tracking, and personalization technology. Many website operators deploy tools that record which links are clicked, how long users stay, how often they return, and how they navigate — and enrich this data into profiles of individual users (LfD Niedersachsen). As soon as pure reach measurement turns into individual profile building, the legal assessment shifts considerably. Supervisory authorities view exactly this transition critically.
That data protection on the web is no longer a marginal topic is shown by the numbers: since 2018, GDPR fines exceeding 7.1 billion euros have been imposed, including 1.2 billion euros in 2025 alone (CMS GDPR Enforcement Tracker). Through early 2026, the tracker documents 2,245 imposed fines (CMS GDPR Enforcement Tracker). A missing or flawed DPIA falls into the lower fine tier — which does not make it harmless, because it is often the first thing authorities request during an audit. Those keeping an eye on the GDPR requirements for websites in 2026 treat the DPIA as a fixed component, not an optional extra.
Do not confuse the DPIA with the record of processing activities (Art. 30 GDPR). The record lists all processing operations — the DPIA is an in-depth risk analysis for precisely those operations likely to result in a high risk. The record is the inventory list; the DPIA is the expert assessment for the critical items on it.
The Three Cases With an Explicit DPIA Obligation
Art. 35(3) GDPR names three standard examples where a DPIA is mandatory "in particular." This list is not exhaustive, but it marks the clear-cut cases. In the tracking context, the first example is especially relevant, because systematic profiling often begins exactly where advertising and personalization come into play.
Extensive evaluation of personal aspects on an automated basis serving as the foundation for decisions with legal or similarly significant effect (Art. 35(3)(a)). Behavioral and advertising profiles typically fall under this.
Large-scale processing of special categories under Art. 9 — health, religion, political opinion, sex life — or data on criminal offenses (Art. 35(3)(b)). Sensitive, for example, on health portals.
Systematic large-scale monitoring of publicly accessible areas (Art. 35(3)(c)). Classically video surveillance, transferable on the web to large-scale, continuous behavioral monitoring.
The crux lies in the word "large-scale." A small reach measurement of your own blog articles is something different from network-wide tracking across many domains. Regulatory reference values for "large scale" suggest thresholds: roughly 5,000 people for sensitive data, 10,000 people for location, communications, or profiling data, and 50,000 people for other processing (Legiscope). These figures are not hard limits, but they give a dependable ballpark for when tracking no longer passes as "small."
The Nine EDPB Criteria and the Two-Criteria Rule
Beyond the three standard examples, the European Data Protection Board defined nine criteria in WP248 that indicate high risk. The rule of thumb: if two or more criteria apply, a DPIA generally must be carried out — in special cases a single criterion may already suffice (EDPB WP248). For web tracking, this threshold is reached quickly, because several criteria apply simultaneously.
| EDPB criterion (WP248) | Tracking relevance | Relevant for web tracking? |
|---|---|---|
| Evaluation or scoring | Behavioral or marketing profile of a user | Yes, as soon as profiles are built |
| Automated decision | Serving with legal or significant effect | Possible, e.g. dynamic pricing |
| Systematic monitoring | Continuous monitoring of user behavior | Yes, with large-scale tracking |
| Sensitive or highly personal data | Health, religion, or financial context | Depending on industry (e.g. health) |
| Large-scale processing | High user count, many data points | Yes, on high-reach sites |
| Combining datasets | Linking across devices or domains | Yes, with cross-site tracking |
| Vulnerable data subjects | Children, employees, patients | Depending on audience |
| Innovative technologies | Fingerprinting, new tracking methods | Yes, with device fingerprinting |
| Preventing rights | Exclusion from services or contracts | Rare, but conceivable |
Run the math for a typical cross-site advertising tracking setup: evaluation and scoring (1), systematic monitoring (2), combining datasets across domains (3), often also large-scale processing (4). That puts you well above the two-criteria threshold — here the DPIA obligation is not a borderline case but the rule. This is also why supervisory authorities view profiling for advertising purposes especially critically (LfD Niedersachsen).
Even if your assessment concludes that no DPIA is needed, you should record that conclusion in writing. This so-called threshold analysis shows the authority during an audit that you answered the question deliberately and with justification — it is part of your accountability. An undocumented gut decision is worthless in a dispute.
The Mandatory Lists of the Supervisory Authorities
Under Art. 35(4) GDPR, each supervisory authority publishes a list of processing operations for which a DPIA must always be carried out — the so-called mandatory list or blacklist (LfD Niedersachsen). For non-public bodies, the German Data Protection Conference agreed on a joint list, which the Lower Saxony State Data Protection Commissioner also refers to (LfD Niedersachsen). Anyone running a website in Lower Saxony or nationwide should know this list.
The lists name concrete tracking-adjacent examples. Explicitly listed are, for instance, processing operations "for profile building and customer loyalty using prices, discounts, and bonuses" (LfD Niedersachsen). The recording and evaluation of internet usage with the aim of building profiles of individual users is also treated as a critical use case in the accompanying guidance (LfD Niedersachsen). If your processing matches an entry, the DPIA is mandatory — without any further case-by-case assessment.
Important: if your processing is not on the mandatory list, that does not mean no DPIA is needed (LfD Niedersachsen). The list contains only the unambiguous mandatory cases. For everything else, the general risk threshold from Art. 35(1) and the nine EDPB criteria still apply. The mandatory list shortens the assessment in clear cases — it does not replace it.
Beyond the mandatory list, some authorities maintain supplementary guidance for telemedia providers that deepens the Data Protection Conference's position (LfD Niedersachsen). These documents are especially valuable for website operators because they translate the abstract criteria into concrete web technology — from reach measurement through conversion tracking to cross-site profile building. Those who work cleanly here avoid the most common warning-letter and fine risks while strengthening their GDPR-compliant website analytics.
Carrying Out the DPIA in Four Steps
Art. 35(7) GDPR prescribes the minimum content of a DPIA. From this follow four mandatory components that every DPIA must contain (DSK Kurzpapier Nr. 5). The process is iterative: you work through the steps, document the result, and repeat the assessment as soon as the processing changes.
- Description of the processing: Systematically document what is processed — which trackers and services load, which data categories are collected, for which purpose, on which legal basis, and for how long. Without a complete inventory, every subsequent assessment remains piecemeal.
- Necessity and proportionality: Check whether the processing is truly necessary for the purpose and whether a milder means would suffice. This is often where it is decided whether invasive tracking can be replaced by a data-minimizing alternative.
- Assessment of the risks: Evaluate the risks to the rights and freedoms of the affected individuals — typically via a risk matrix of likelihood and severity of the possible consequences. The combination of the two yields the risk level.
- Defining mitigation measures: Define technical and organizational measures that reduce the risk — pseudonymization, data minimization, short retention periods, access controls, cookieless methods. Only when the residual risk is acceptable may the processing begin.
If a high risk remains despite all measures, Art. 36 GDPR requires prior consultation of the supervisory authority. In practice this is rare — usually the risk can be reduced through the right technology choice to the point where it becomes acceptable. This is exactly the lever the decision for data-minimizing tracking pulls: it not only reduces the risk in the matrix but often the number of applicable criteria in the first place.
processing:
purpose: "reach measurement of your own website"
legal_basis: "Art. 6(1)(f) / consent where applicable"
data_categories: ["truncated IP", "page views", "time on page"]
retention: "aggregated, no individual profiles"
necessity:
required: true
milder_means_checked: "cookieless instead of cross-site tracking"
risk_matrix:
likelihood: "low" # low | medium | high
severity: "low" # low | medium | severe
result: "low risk"
mitigation_measures:
- "no cookies, no recognition across session boundaries"
- "data minimization, aggregation instead of individual profiles"
- "short retention periods, access control"How Cookieless Tracking Cuts Risk and Effort
The most effective lever to defuse the DPIA obligation is the choice of technology. Classic cross-site tracking with cookies quickly meets several EDPB criteria at once: it builds profiles, monitors systematically, and combines datasets. Cookieless tracking without recognition across session boundaries avoids exactly this escalation — it builds no cross-device individual profiles and thereby reduces both the number of applicable criteria and the severity of the risks in the matrix.
This is more than a legal trick: those who collect less personal data have less to secure, less to document, and can often even reduce the consent requirement. A GDPR-compliant analytics solution without cookies delivers dependable reach figures without falling into the high-risk category. The difference is substantial: a costly processing operation requiring consultation becomes one that frequently needs no DPIA at all — because it never crosses the threshold in the first place.
| Aspect | Cookie tracking (cross-site) | Cookieless tracking |
|---|---|---|
| Individual profiles | possible across devices | no persistent individual profiles |
| EDPB criteria met | often three to four | considerably fewer |
| Risk in the matrix | tends to be high | tends to be low |
| DPIA likelihood | generally mandatory | frequently dispensable |
| Consent need | regularly required | reduced depending on design |
Related methods benefit from the same logic. Those who run session recording in a privacy-compliant way with first-party infrastructure mask inputs and avoid transfer to third parties — thereby reducing the risk that would otherwise feed into the DPIA. Data minimization is the best preparation for any data protection audit.
Fines and Real-World Enforcement
A missing DPIA carries a penalty of up to 10 million euros or 2% of worldwide annual turnover under Art. 83(4) GDPR — whichever is higher (Art. 83(4) GDPR). This is the lower of two fine tiers, yet authorities are increasingly enforcing it. In France, the supervisory authority CNIL imposed a total of 83 sanctions worth around 486.8 million euros in 2025, with cookie violations and advertising trackers accounting for the bulk of that figure (CNIL).
The most prominent cases concerned exactly the tracking environment: in 2025 the CNIL imposed 325 million euros on a major corporation over advertising cookies without valid consent and 150 million euros on an online retailer that set advertising cookies on page load — before users could accept or reject (CNIL/EDPB). These proceedings show the pattern: anyone running tracking without a sound legal basis and without a documented risk analysis becomes a target.
When calculating fines, a documented, careful DPIA acts as a mitigating factor — it proves the company recognized and addressed the risks. Conversely, a controller without a DPIA, without a record of processing, and without a documented legal basis starts essentially at zero on the cooperation assessment. The DPIA is therefore not only an obligation but a safeguard.
For German SMBs the effort is noticeable but manageable. According to Bitkom, 97% of companies rate the data protection effort as high, of which 44% as very high (Bitkom 2025). At the same time, 81% say the GDPR makes their business processes more complicated (Bitkom 2025). This burden can be reduced precisely where it is tackled at the root: through data-minimizing technology that keeps processing operations out of the high-risk zone in the first place. Those who want to avoid GDPR fines start with risk reduction, not crisis management.
Embedding the DPIA as an Ongoing Process
A DPIA is not a document you write once and file away. Art. 35(11) GDPR requires a review when the risk of the processing changes. With websites, this happens constantly: a new plugin loads an additional tracker, a marketing tool is integrated, a service provider switches its sub-processors. Each of these changes can shift the risk assessment — and thereby invalidate the DPIA's basis.
This is exactly where data protection and monitoring connect. Without continuous monitoring, you notice only months later that your website suddenly loads trackers that never appeared in the original DPIA. That is not only a compliance problem but also a security issue: unknown embedded scripts can leak data unnoticed. Those who also monitor the integrity of embedded scripts via Subresource Integrity detect changed third-party resources before they become a data protection or security risk.
The practical approach: treat the DPIA like backups or server logs — as a fixed part of the operational routine. An automated inventory of the loaded trackers, cookies, and services provides the dependable data basis on which the description of the processing builds. The XICTRAQ GDPR compliance scan captures exactly that and reports changes — so the DPIA stays current instead of quietly aging after the next website update. So that deviations do not slip through, every relevant change should trigger a notification across all configured channels. Routine work such as scheduled updates can be hidden via maintenance windows to avoid false alerts.
This article is based on data from: Art. 35 GDPR (Data Protection Impact Assessment, paras. 1, 3, 4, 7, 11), Art. 36 GDPR (prior consultation), Art. 83(4) GDPR (fine framework), EDPB WP248 rev.01 (nine criteria, two-criteria rule), DSK Kurzpapier Nr. 5 (DPIA components, definition), Lower Saxony State Data Protection Commissioner (mandatory lists, web tracking, profiling), CMS GDPR Enforcement Tracker 2025/2026 (fine totals, case counts), CNIL (2025 sanctions, cookie fines), EDPB (CNIL proceedings), Bitkom 2025 (data protection effort, implementation status), Legiscope (large-scale thresholds).