How to Carry Out a DPIA in Ireland: Step-by-Step Guide
Last updated 2 November 2026. General information only, not legal advice.
A data protection impact assessment (DPIA) is a structured way to find and reduce privacy risks before you start a new type of processing. For Irish businesses, it is required under Article 35 of the GDPR where processing is likely to result in a high risk to individuals. This guide walks through how to carry one out, step by step. If you are still deciding whether you need one, see our guide on when a DPIA is required in Ireland.
What a DPIA is and why it matters
A DPIA is a documented risk assessment of a specific processing activity. Article 35 GDPR requires it to be carried out before the processing begins, and the Data Protection Commission (DPC) recommends a DPIA for any major new project involving personal data, even where high risk is not obvious. A DPIA also supports the accountability principle: it is evidence that you considered the risks and acted on them.
Failing to carry out a required DPIA can lead to administrative fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher (Article 83(4)). See our guide to GDPR fines in Ireland.
Step 1: Decide whether you need a DPIA
Start with a short screening. Article 35(3) makes a DPIA mandatory for: systematic and extensive evaluation of individuals based on automated processing (including profiling) that produces significant effects; large-scale processing of special-category or criminal-offence data; and large-scale systematic monitoring of a publicly accessible area.
The DPC has also published a list of processing operations that require a DPIA. It includes, among others, systematic monitoring or tracking of individuals’ location or behaviour, large-scale profiling, profiling of vulnerable people (including children) for marketing, using profiling or special-category data to decide access to services, and combining datasets from different sources in a way that contributes to profiling. Record the screening outcome and your reasons, even where you conclude a DPIA is not needed. Operations such as CCTV and employee monitoring frequently trigger one.
Step 2: Describe the processing
Article 35(7)(a) requires a systematic description of the processing and its purposes. Document:
- what personal data you collect and from whom;
- why you process it, and your lawful basis under Article 6 (and Article 9 condition if special-category data is involved);
- how data flows: collection, storage, access, sharing with processors or third parties, and deletion;
- how much data and how many people are affected, and for how long;
- the technology involved, including any new or high-risk tools.
If you already keep a record of processing activities, it is a good starting point.
Step 3: Assess necessity and proportionality
Under Article 35(7)(b) you must show the processing is necessary for its purpose and proportionate. Ask whether you could achieve the same aim with less data, with anonymised data, or with a less intrusive method. Check that data minimisation, storage limitation, transparency to individuals and the ability to honour data subject rights are built in.
Step 4: Identify and rate the risks
Article 35(7)(c) requires an assessment of the risks to individuals’ rights and freedoms. Think about harm to people rather than to the business: unauthorised access, loss of confidentiality, discrimination, identity theft or fraud, financial loss, loss of control over data, or distress. For each risk, rate the likelihood and the severity (a simple low/medium/high matrix is usually sufficient for an SME) and record the resulting level of risk.
Step 5: Decide on measures to reduce the risks
Article 35(7)(d) requires the measures envisaged to address the risks. Examples include: reducing the data collected, pseudonymisation or encryption, access controls and logging, retention limits (see our retention schedule guide), staff training, clearer privacy notices, and contracts with processors. For each risk, record the measure, who owns it, and the residual risk that remains afterwards.
Step 6: Consult the right people
If you have a Data Protection Officer, Article 35(2) requires you to seek their advice and it is good practice to record it. Where appropriate, Article 35(9) also asks controllers to seek the views of the people affected or their representatives. Involve IT, HR or operations and any processor whose systems are involved.
Step 7: Sign off and, if needed, consult the DPC
Record the outcome and obtain sign-off from a senior decision-maker. If the residual risk is still high after your measures, you must consult the DPC before starting the processing (Article 36 GDPR). According to the DPC, you submit the DPIA and supporting information to consultation@dataprotection.ie, and the DPC may respond within up to eight weeks, which can be extended by up to six weeks for complex processing. Plan project timelines with this in mind.
Step 8: Keep the DPIA under review
A DPIA is not a one-off document. Article 35(11) requires a review where necessary, at least when the risk of the processing changes: a new supplier, a new purpose, a new technology or a data breach (see our data breach guide) are common triggers.
Common DPIA mistakes
Typical problems include carrying out the DPIA after the system is already live, copying a generic template without describing the real processing, listing risks to the business instead of to individuals, and failing to follow through on the agreed measures. For a general overview of obligations, see our GDPR guide for small businesses and our GDPR and data protection guides hub.
Need help with this? Plus Promotions Limited provides DPIA support for Irish businesses, from €495. It is a compliance consultancy service.
Frequently asked questions
Who is responsible for carrying out a DPIA?
The controller is responsible. The work can be delegated to staff or an adviser, and the DPO (if you have one) must be consulted, but the business remains accountable.
How long does a DPIA take?
It depends on the complexity of the processing. A simple project may be documented quickly, while large or novel processing can require extensive analysis and consultation.
Do I have to publish my DPIA?
There is no GDPR requirement to publish a DPIA, though publishing a summary can help transparency. You must be able to produce it if the DPC asks.
What if the DPIA shows the risk is still high?
If you cannot reduce the high residual risk, you must consult the DPC under Article 36 before starting the processing.
Is there an official DPIA template?
The DPC publishes guidance on DPIAs and its list of processing that requires one, but the GDPR does not prescribe a form. What matters is that the assessment covers the Article 35(7) minimum content.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
