When is a DPIA required in Ireland?
Last updated 20 October 2026. General information only, not legal advice.
A data protection impact assessment (DPIA) is required under Article 35 GDPR before you start processing personal data that is likely to result in a high risk to people’s rights and freedoms. In Ireland, that includes the cases listed in the GDPR itself and the types of processing on the Data Protection Commission’s (DPC) own list. If your planned processing is not on either list, you still need to assess whether it is high risk and record your reasoning.
The three cases named in the GDPR
Article 35(3) GDPR says a DPIA is required in particular where there is:
- a systematic and extensive evaluation of personal aspects of individuals based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based;
- large-scale processing of special categories of data (such as health or biometric data) or of data about criminal convictions and offences; or
- systematic monitoring of a publicly accessible area on a large scale.
The DPC’s list of processing that needs a DPIA
Under Article 35(4), each supervisory authority publishes a list of processing operations that require a DPIA. The DPC’s list, finalised in 2018, includes, among other items: systematic monitoring or tracking of individuals’ location or behaviour; large-scale profiling; profiling vulnerable people, including children, to target marketing or online services at them; large-scale use of personal data for a new purpose different from the one it was collected for; combining or cross-referencing datasets in ways that significantly contribute to profiling; and certain uses of biometric or genetic data. Check the current list on the DPC website before relying on this summary.
What if it is not on a list?
The European guidelines on DPIAs, which the DPC refers to, set out criteria for judging whether processing is likely to be high risk, such as evaluation or scoring, automated decision-making, systematic monitoring, sensitive data, large-scale processing, vulnerable individuals and new technologies. As a rule of thumb, processing that meets two or more criteria will usually need a DPIA. If you decide one is not needed, document why.
Timing matters. The DPIA must be done before the processing starts, and reviewed when the risks change. If it shows a high residual risk that you cannot reduce, Article 36 requires you to consult the DPC before going ahead. For a wider view of your obligations, see our GDPR guide for small businesses in Ireland, and our guide on whether you need a Data Protection Officer, since the DPO advises on DPIAs where one is designated.
Need help with this? Plus Promotions Limited provides DPIA support for Irish businesses, from €495.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
FAQ
Is a DPIA mandatory for small businesses in Ireland?
The size of the business is not the test. A DPIA is required for any controller, large or small, whose planned processing is likely to result in a high risk to individuals. Most routine small-business processing, such as payroll or a customer mailing list, will not meet that threshold, but a small clinic processing health data at scale or a small firm using CCTV or tracking in a way that meets the criteria above may need one.
Who carries out a DPIA?
The controller is responsible for ensuring it is carried out. Under Article 35(2), the controller must seek the advice of the Data Protection Officer, where one has been designated. The work itself can be done by staff, an outsourced DPO or an external adviser, but responsibility stays with the controller.
What happens if you do not carry out a required DPIA?
Failing to carry out a DPIA when one is required is an infringement of Article 35. Under Article 83(4)(a) GDPR, infringements of the controller’s obligations under Articles 25 to 39 can attract administrative fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher. The Data Protection Commission decides fines case by case.
