The DPIA: when?
Complete plan
A data protection impact assessment (DPIA) is mandatory before processing likely to create a high risk. The quick test: nine criteria, two or more, and the CNIL's list.
- 2 min
- 3-question check
- English · Français
- Attestation
You will be able to
- Know what a DPIA is and that it is done before the processing
- Apply the two-criteria rule among the nine, and know the CNIL's list
- Know who carries it out (the company, with the DPO's advice) and what to do about a remaining high risk
The module
2 min-
The DPIA: when? 2 min
-
Knowledge check
3 questions, pass mark 80 %. Explanations after each answer; you can try again.
-
Attestation
One per person, with the date, the score and the frameworks covered — anyone can check it online with its code.
Sources
- RGPD, art. 35 (analyse d'impact) et 36 (consultation préalable)
- CNIL, AIPD : les neuf critères du G29/CEPD et la liste des traitements pour lesquels une AIPD est requise
- CNIL, règlement type biométrie sur les lieux de travail (2019) : usage à justifier, AIPD obligatoire
Version 1 · updated October 5, 2026