DPIA vs PIA: what each is, when you need one, and what goes in it

What is a DPIA?

Under Article 35(1) of the GDPR, where a type of processing, taking into account its nature, scope, context and purposes, is likely to result in a high risk to the rights and freedoms of natural persons, the controller must carry out a DPIA before the processing. A single assessment may cover a set of similar processing operations that present similar high risks. Article 35(3) names three cases where a DPIA is always required:

• a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal or similarly significant effects;
• processing on a large scale of special categories of data, or of data relating to criminal convictions and offences;
• systematic monitoring of a publicly accessible area on a large scale.

Each supervisory authority also publishes a list of the kinds of processing that require a DPIA (Article 35(4)). The European guidelines on DPIAs, endorsed by the European Data Protection Board, give nine criteria: evaluation or scoring; automated decision-making with legal or similar significant effect; systematic monitoring; sensitive or highly personal data; data processed on a large scale; matching or combining datasets; data concerning vulnerable data subjects; innovative use or applying new technological or organisational solutions; and processing that prevents people from exercising a right or using a service or a contract. In most cases, processing that meets two criteria requires a DPIA.

Article 35(7) sets the minimum content: a systematic description of the processing and its purposes; an assessment of necessity and proportionality; an assessment of the risks to individuals; and the measures envisaged to address them. Where the DPIA indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate it, the controller must consult the supervisory authority before starting (Article 36(1)).

Sources: GDPR, Regulation (EU) 2016/679, EUR-Lex; Article 29 Working Party, Guidelines on DPIA (WP248 rev.01), endorsed by the EDPB.

What is a PIA?

"Privacy impact assessment" is the general term used before the GDPR and still used in many organisations and standards; the European DPIA guidelines themselves refer to the ISO/IEC 29134 work on privacy impact assessment. Used loosely, a PIA is any documented review of a project's privacy risks. A DPIA is the specific, legally defined form required by the GDPR.

What does California now require?

The CCPA regulations (Article 10, sections 7150 to 7157, effective 1 January 2026) require a business whose processing presents significant risk to consumers' privacy to conduct a risk assessment before starting that processing (§ 7150(a)). Six activities present that risk (§ 7150(b)):

1. selling or sharing personal information;
2. processing sensitive personal information (with a narrow exception for certain employment purposes);
3. using automated decisionmaking technology (ADMT) for a significant decision concerning a consumer;
4. using automated processing to infer or extrapolate a person's traits or behaviour from systematic observation of them as an applicant for education or a job, a student, an employee or an independent contractor;
5. using automated processing to do so based on their presence in a sensitive location;
6. processing personal information that the business intends to use to train ADMT for a significant decision, or facial-recognition, emotion-recognition or other technology that verifies identity or identifies or profiles people.

The report must document, among other things, the purpose, the categories of personal information, the operational elements, the benefits, the negative impacts on consumers' privacy, the safeguards, whether the business will proceed, who provided information, and the date the assessment was reviewed and approved (§ 7152). The stated goal is to restrict or prohibit processing whose risks to the consumer outweigh its benefits (§ 7154).

Dates. For processing that began before 1 January 2026 and continues after that date, the assessment must be done by 31 December 2027 (§ 7155(b)). Assessments must be reviewed at least once every three years, and updated within 45 calendar days of a material change (§ 7155(a)). For assessments conducted in 2026 and 2027, the business must submit summary information and an attestation, made by a member of executive management, to the California Privacy Protection Agency by 1 April 2028 (§ 7157(a), (b)(5) and (c)). The Agency or the Attorney General may ask for the full reports at any time, to be provided within 30 calendar days (§ 7157(e)). Reports are kept for as long as the processing continues or five years after the assessment, whichever is later (§ 7155(c)).

Source: CCPA Regulations, effective 1 January 2026 (California Privacy Protection Agency).

How do they compare?

Can one document serve both?

Yes, if it contains everything each law asks for. The California regulations allow a business to use an assessment prepared for another purpose, provided it contains, or is paired with, the information section 7152 requires (§ 7156(b)). In practice, add to a GDPR DPIA the California fields it usually lacks: the operational elements, the benefits, the names of contributors, the decision whether to proceed, and the approval.

Under the EU AI Act, some deployers of high-risk AI systems must also carry out a fundamental rights impact assessment (Article 27); see our EU AI Act timeline.

Checklist

• Screen every new project against Article 35 (and the national list) and against § 7150(b)
• Where a listed case or criterion applies but you decide no DPIA is needed, record the reasons and the DPO's views
• Use one template that covers Article 35(7) and § 7152
• Involve the DPO (EU) and the employees and external parties § 7151 describes (California)
• Finish before the processing starts
• List all processing begun before 2026 that § 7150(b) covers; assess it by 31 December 2027
• Diary the 1 April 2028 submission and name the executive who will attest
• Set review dates: at least every three years, and within 45 days of a material change

Questions people ask

Is a PIA the same as a DPIA? Not quite. A DPIA is the GDPR's defined assessment; a PIA is a general term. A well-built PIA can meet the DPIA requirements if it covers Article 35(7).

Do US companies need a DPIA? Only where the GDPR applies to the processing. Under the CCPA, a business needs a risk assessment for the activities in § 7150(b), whether or not it also needs a DPIA.

What happens if we skip it? Under the GDPR, the obligations in Articles 25 to 39, which include Article 35, are subject to fines of up to 10 million euros or, for an undertaking, up to 2% of its total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)). Under the CCPA, the submission to the Agency includes an attestation made under penalty of perjury (§ 7157(b)(5)).

Who signs? Under the GDPR, the controller carries out the DPIA and the DPO advises. In California, the report records the date it was reviewed and approved, and a member of executive management makes the submission to the Agency.

Sources: GDPR, Article 83, EUR-Lex; CCPA Regulations, § 7157 (CPPA).

Update log

• 16 October 2026: first published; sources checked and citations added the same day.