# Data protection impact assessment (DPIA): when you need one and how to do it

URL: https://pulsaiq.com/en/guides/data-protection-impact-assessment/
Last reviewed: 2026-11-04
Language: en
Legal basis: GDPR Art. 35 and 36

Management wants to switch on a new system and someone has asked whether "this needs a DPIA". You can answer that in ten minutes. If the answer is yes, here is a method that fits into a week of work, with every rule traced to its source.

## In two minutes

- **Do the DPIA before the processing starts**, never afterwards. It's required when processing is likely to result in a high risk to people, especially with new technologies. Art. 35(1)
- **To find out whether you need one, use three filters:** the three cases in Art. 35(3), the ten items on the DPC's list and the nine European criteria. Processing that meets two criteria needs a DPIA in most cases.
- **A DPIA has four required parts:** a description of the processing, an assessment of whether it's necessary and proportionate, an assessment of the risks to people, and the measures that reduce them. Art. 35(7)
- **The controller carries it out.** The DPO gives advice, the supplier provides the technical information and, where appropriate, you ask the people affected for their views. Art. 35(2) and (9)
- **If the risk is still high after the measures, consult the DPC before you start** (the ICO in the UK). The authority has up to eight weeks to reply, extendable by six more. Art. 36

## Who this guide is for

Anyone in a small or medium-sized business who has to decide whether a new project needs a data protection impact assessment (DPIA), and DPOs or consultants who support clients and want a method they can use again and again. If you look after several clients, the <a href="/en/guides/external-dpo-multiple-clients/">guide for external DPOs with several clients</a> explains how to give advice without ending up owning the decision.

**Who it isn't for.** Anyone who needs a legal opinion on a specific case. This guide explains the rules and a practical method, but it doesn't replace professional advice.


## The clinic that wanted facial recognition at the door

Clínica Sorriso is a dental clinic with 22 staff. A month ago the clinic's director rang Inês, its external DPO: "We're putting facial recognition on the entrance. Do the impact assessment for us and sign it off. We trust you."

Inês didn't sign. She explained that the assessment is the clinic's job, gave them a template and said she'd send her advice in writing. This morning Sofia, the practice manager, opens the template for the first time. She has a quote from the system supplier, a management meeting in three weeks and no idea where to start.

Follow her through the assessment, one step at a time.

Clínica Sorriso, Sofia, Inês and the other characters are fictional. The rules, lists and guidance cited are real.


## What a DPIA is

A data protection impact assessment (DPIA) is a written analysis, done before a processing operation starts, that answers four questions: what are we going to do with the data, do we really need to do it this way, what could go wrong for the people involved, and what will we do to prevent it (Art. 35(7)).

Under the old rules, every processing operation had to be notified to the regulator. The GDPR scrapped that duty and put this assessment, focused on high-risk processing, in its place (recitals 89 and 90). So you don't send your DPIA to the Data Protection Commission (DPC), Ireland's data protection authority. You keep it on file, ready to show if the DPC asks for it. It only goes to the DPC if you can't bring the risk down, through the prior consultation explained below.

Done properly, a DPIA saves money. Changing a project on paper costs far less than switching off a system you've already paid for because the DPC found it unlawful.


## Do you need one? The three filters

Run the processing through these three filters, in this order. If any of them says yes, do the DPIA.

### Filter 1: the three GDPR cases

A DPIA is required (Art. 35(3)), among other cases, when there is:

1. a systematic and extensive evaluation of personal aspects, based on automated processing (including profiling), that leads to decisions with legal effects on the person or that affect them in a similarly significant way. Example: a system that turns down credit applications based on an automated score;
2. large-scale processing of special categories of data (health, biometrics, ethnic origin and others) or of data on criminal convictions and offences;
3. large-scale systematic monitoring of publicly accessible areas, such as CCTV in a shopping centre.

"Large scale" doesn't cover the files of an individual doctor, other health professional or lawyer on their own patients or clients. In those cases a DPIA shouldn't be mandatory (recital 91).

### Filter 2: the DPC's list

The DPC has published the list of processing operations that, in Ireland, require a DPIA on top of the three cases above: the [List of Types of Data Processing Operations which require a Data Protection Impact Assessment](https://www.dataprotection.ie/sites/default/files/uploads/2018-11/Data-Protection-Impact-Assessment.pdf) (revised 15 November 2018). It applies where a documented screening or preliminary risk assessment shows the processing is likely to result in a high risk. In plain English, the list covers:

1. Using personal data on a large scale for a purpose other than the one it was collected for (Art. 6(4)). Example: a gym chain using years of door-entry logs for a new marketing project.
2. Profiling vulnerable people, including children, to target marketing or online services at them. Example: an app that profiles teenagers to decide which ads they see.
3. Using profiling, algorithms or special category data to decide who gets access to a service, or with legal or similarly significant effects. Example: an insurer using answers to a health questionnaire to decide who gets cover.
4. Systematically monitoring, tracking or observing people's location or behaviour. Example: GPS in company vans used to rate drivers' performance.
5. Profiling people on a large scale. Example: shopping profiles of every customer of a retail chain.
6. Biometric data used to uniquely identify or authenticate people, combined with at least one other criterion from the European DPIA guidelines (filter 3). Example: facial recognition to control a staff entrance.
7. Genetic data, combined with at least one other criterion from those guidelines. Example: genetic tests offered to residents of a care home.
8. Personal data obtained indirectly when the GDPR's transparency rules aren't being met, including when relying on the exemptions for impossibility or disproportionate effort. Example: a bought-in list with health data whose subjects were never told.
9. Combining, linking or cross-referencing datasets where this contributes significantly to, or is used for, profiling or behavioural analysis, especially when the datasets come from different sources, purposes or controllers. Example: matching a gym's member list with data bought from a data broker.
10. Large-scale processing where the Data Protection Act 2018 requires "suitable and specific measures" to protect people's rights. Example: a national pharmacy chain processing its customers' prescription data.

The examples are ours. The exact wording of each item is in the DPC's list (link in the sources). The DPC points out that the list is not exhaustive: other high-risk processing may need a DPIA even though it isn't on it.

The GDPR also lets each authority publish a list of processing that does **not** need a DPIA (Art. 35(5)). As of 4 November 2026, we couldn't find one on the DPC's website.

**If you're in the UK**, the rules come from the UK GDPR and the regulator is the Information Commissioner's Office (ICO), which keeps its own list in its [DPIA guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/examples-of-processing-likely-to-result-in-high-risk). It has ten types: innovative technology, denial of service, large-scale profiling, biometric data, genetic data, data matching, invisible processing, tracking, targeting children or other vulnerable people, and risk of physical harm. Like the DPC, the ICO requires a DPIA for biometric identification combined with another criterion from the European guidelines, and it gives workplace access systems as an example.

### Filter 3: the nine European criteria

If filters 1 and 2 don't catch the processing, use the nine criteria from the European guidelines on DPIAs (WP248), which the European Data Protection Board (EDPB) endorsed and which the DPC drew on for its list:

1. evaluating or scoring people, including profiling and predicting;
2. automated decisions with legal or similarly significant effects;
3. systematic monitoring of people;
4. sensitive data or data of a highly personal nature;
5. data processed on a large scale;
6. matching or combining datasets collected for different purposes;
7. data about vulnerable people, such as children, employees, patients or older people;
8. innovative technological or organisational solutions, such as combining fingerprint and facial recognition to improve physical access control;
9. processing that prevents people from exercising a right or using a service or contract.

The guidelines' rule of thumb: "In most cases, a data controller can consider that a processing meeting two criteria would require a DPIA to be carried out." A single criterion can be enough if the risk is obvious.

Employees count as vulnerable because of the imbalance of power between them and their employer. That's why almost any project that monitors or measures staff ticks two criteria straight away.

### Some cases, run through the filters

- **Facial recognition at Clínica Sorriso's staff entrance.** Yes. DPC list, item 6. Criteria 4, 7 and 8.
- **Software that logs employees' computer and internet activity.** Probably yes. Criteria 3 and 7, and it may also fall under item 4 of the DPC list.
- **Automated screening of job applications that rejects candidates without human review.** Yes. Art. 35(3)(a). Criteria 1, 2 and 7.
- **Wristbands that send care home residents' vital signs to the staff.** Yes. Not on the DPC list as such, but criteria 4 and 7: two criteria, so in most cases a DPIA.
- **Patient files at a single-doctor practice.** Not mandatory (recital 91). Criteria 4 and 7, but not large scale.
- **Monthly newsletter to customers who signed up for it.** No. No criteria met.

These are illustrations only. The answer always depends on the facts of each processing operation.

### If you decide you don't need one, write down why

When a processing operation meets a criterion but you conclude there's no high risk, record your reasons and the DPO's advice. The European guidelines ask for exactly that. In your <a href="/en/guides/record-of-processing-activities/">record of processing activities</a>, a "DPIA needed?" column filled in with "No, because…" and the date is a good place to do it.


## Who does what

- **Controller.** Makes sure the DPIA is carried out and takes the decisions. It can hand the work to someone inside or outside the organisation, but it stays responsible for it (Art. 35(2)).
- **DPO, if you have one.** Advises on whether a DPIA is needed, which method to use and whether the conclusions comply with the GDPR. That advice, and what was decided, are recorded in the DPIA (Art. 35(2); Art. 39(1)(c)).
- **Processor (the system supplier).** Gives the controller the information it needs to carry out the assessment (Art. 28(3)(f)).
- **The people affected, or their representatives.** Are asked for their views on the planned processing, where appropriate (Art. 35(9)).
- **Internal teams (IT, security, the people who'll use the system).** Explain how the system works and what risks they see day to day.

Clínica Sorriso's director wanted Inês to do the assessment and sign it. The European guidelines say the DPIA belongs to the controller, and the DPO's advice is only worth something if it's independent. So Sofia does the work, Inês advises and management decides.


## The method in six steps

For processing like Clínica Sorriso's, allow a week of work spread over two or three calendar weeks, because you'll be waiting on answers from the supplier. Simple processing takes two or three days.

### 1. Describe the processing as if to someone who's never seen it

Write down the purpose in one sentence, what data you collect, whose it is, where it comes from, where it's stored, who can access it, how long you keep it and which suppliers are involved. If you rely on legitimate interests, say what they are (Art. 35(7)(a)). A simple drawing of how the data flows, from the camera to the server, helps more than a page of text.

Sofia puts three questions to the supplier in writing. Does the system store photos, or only a mathematical template of each face? Where is that template kept? Who can see the entry logs? The answers come back: in the version the clinic was quoted for, the templates of all 22 faces are kept on a supplier's server outside the clinic.

### 2. Ask whether you really need to do it this way

Explain what problem the processing solves and why no less intrusive option would do (Art. 35(7)(b)). Then check the lawful basis, whether you're collecting only the data you need, how long you'll keep it and how you'll tell people about it.

The clinic's real problem is access cards that staff lend to each other and lose. A card with a personal code would fix almost all of that. There's a second point to weigh: biometric data used to identify someone is special category data (Art. 9), so the clinic needs one of the exceptions in Art. 9(2) on top of a lawful basis. We found no Irish rule written specifically for employee biometrics; the Data Protection Act 2018 sets the Irish conditions for special category data (sections 45 to 55). In the UK, the ICO's [guidance on biometric time and attendance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/can-we-use-biometric-data-for-time-and-attendance-control-and-monitoring/) says it's likely to be very hard to justify biometric access control without offering staff an alternative, such as a swipe card or PIN. If the director also wanted to use the system to time breaks, that would be a new purpose, and the DPIA would have to justify it separately.

### 3. Assess the risks from the point of view of the people involved

What counts here is the risk to the people whose data you process, not to the business (Art. 35(7)(c)). For each risk, think about what could happen, how likely it is and how serious it would be. Three questions help you cover everything. What if someone without permission gets at the data? What if the data is changed or turns out to be wrong? What if it disappears or becomes unavailable?

Sofia's list:

- a leak of the face templates would be serious, because you can't change your face the way you change a password;
- the system could later be used to watch working hours and breaks, without anyone ever deciding that;
- the system might fail to recognise someone and leave them stuck at the door;
- a member of staff who doesn't want to give the system their face might feel they have no choice.

### 4. Decide the measures that reduce each risk

For each risk, write down the measure, who will put it in place and by when (Art. 35(7)(d)). The measures that work best usually change how the processing is designed, rather than adding security on top.

The clinic's measures:

- each employee's face template is stored on their own card and compared only in the reader at the door, with no central database and no photos;
- the Art. 28 contract with the supplier states that the entry logs are used only for access control;
- the door also opens with a card and code, for anyone the system doesn't recognise or who'd rather not use their face;
- staff get the Art. 13 information before the system goes live, and the clinic asks for their views at a meeting (Art. 35(9)).

### 5. Close the DPIA with a signed decision

With the measures in place, assess the risk that's left. Attach the DPO's advice and, if management doesn't follow it, the reason why. The final decision belongs to whoever runs the organisation, with their name and the date.

If the remaining risk is still high, don't start the processing: consult the DPC first.

At Clínica Sorriso, Inês agrees in writing that with the template kept on the card and the card-and-code alternative, the risk is no longer high. Management approves this version. Had the conclusion gone the other way, the clinic would have had to consult the DPC before switching the system on.

### 6. Set a date for the next review

The DPIA stays with the processing for as long as it runs. Review it at least whenever the risks change: a new supplier, more data, a new purpose, an incident (Art. 35(11)). The European guidelines say a DPIA should be continuously reviewed and regularly reassessed, without setting a deadline. A yearly review, plus one whenever something significant changes, is a sensible routine.


## What a DPIA must contain

Use this list to check that your DPIA is complete. The first four items are the legal minimum; the rest come from the European guidelines.

- **Description.** Purpose, data, people covered, recipients, retention periods, systems and suppliers (Art. 35(7)(a)).
- **Necessity and proportionality.** Lawful basis, minimum data, retention periods, information given to people, how they exercise their rights (Art. 35(7)(b)).
- **Risks.** Each risk with its source, likelihood and severity for the people involved (Art. 35(7)(c)).
- **Measures.** Measures, safeguards and procedures, each with an owner and a deadline (Art. 35(7)(d)).
- **DPO's advice.** In writing, dated, with what management decided about it.
- **Views of the people affected.** How you asked them, or why it wasn't appropriate to.
- **Decision.** The remaining risk, approval with a name and date, and a consultation with the DPC if needed.
- **Review.** The date of the next review and what would bring it forward.

One DPIA can cover several similar processing operations that present similar high risks (Art. 35(1)). A group of clinics with the same system on every entrance can do one assessment for all of them.


## Six mistakes that make a DPIA useless

- **Doing it after buying the system.** By then nobody wants to hear that the project should change. The law asks for the DPIA before the processing.
- **Assessing the risk to the business.** Fines and reputation aren't what a DPIA measures. What counts is what could happen to people.
- **Skipping necessity.** Many DPIAs describe the system and jump straight to security, without asking whether there was a less intrusive way to get the same result.
- **Copying the supplier's documentation.** The supplier knows the product. It doesn't know your setting, your staff or your customers.
- **Getting the DPO to write and sign it.** The DPO advises. A DPO who does the assessment can no longer check it impartially.
- **Filing it and forgetting it.** A 2021 DPIA for a system that has since changed supplier and purpose no longer describes what you actually do.


## When the risk won't come down: prior consultation with the DPC

If the DPIA shows the processing would be high risk without the controller's measures, and those measures aren't enough to bring the risk down, you must consult the DPC **before** you start (Art. 36(1); recital 94).

Send the request by email to consultation@dataprotection.ie, clearly marked as a statutory prior consultation under Article 36 of the GDPR, as the DPC's [Prior Consultation](https://www.dataprotection.ie/organisations/know-your-obligations/data-protection-impact-assessments/prior-consultation) page explains. Include the full DPIA and any supporting documents, who is responsible for what (controller, joint controllers, processors), the purposes and means of the processing, the measures and safeguards you plan, and your DPO's contact details. The DPC's page doesn't mention a fee. It does say it welcomes advance notice that a submission is on its way. In the UK, you consult the ICO, under the same article of the UK GDPR.

If the DPC considers that the processing would breach the GDPR, it gives written advice no later than eight weeks after receiving the request. For complex processing, that period can be extended by up to six weeks, and the DPC tells you about the extension within one month. The clock stops while the DPC waits for any information it has asked for (Art. 36(2)).

With the extension, a reply can take up to 14 weeks, not counting those pauses. Build that margin into your launch date, and don't start the processing while you wait.


## Free templates and tools

You don't need to invent a form. These templates come from official sources:

- **[EDPB, DPIA template](https://www.edpb.europa.eu/public-consultations/template-for-data-protection-impact-assessment_en)** (Word, with an explanatory note). Designed as a common basis for European authorities. The EDPB says the authorities will adopt it either as their sole standard or as a "meta-template" for their national ones. Available in English only. This is version 1, from April 2026; the public consultation closed on 9 June and the final version hadn't been published by 4 November 2026. Using it isn't mandatory.
- **[DPC, Sample DPIA Template](https://www.dataprotection.ie/sites/default/files/uploads/2024-11/Sample-DPIA-Template-EN.pdf)** (PDF). The DPC's own short template, in seven steps, from identifying the need for a DPIA to signing it off. The DPC says it's for use as a guide only.
- **[CNIL, PIA software](https://www.cnil.fr/fr/outil-pia-telechargez-et-installez-le-logiciel-de-la-cnil)**. Open-source software that walks you through a DPIA step by step, available in English. It follows the method of the CNIL, France's data protection authority.
- **CNIL, PIA guides:** [method](https://www.cnil.fr/sites/default/files/atoms/files/cnil-pia-1-fr-methode.pdf), [templates](https://www.cnil.fr/sites/default/files/atoms/files/cnil-pia-2-fr-modeles.pdf) and [knowledge bases](https://www.cnil.fr/sites/default/files/atoms/files/cnil-pia-3-fr-basesdeconnaissances.pdf). Examples of risks and measures to get your analysis going. In French.
- **[WP248 guidelines](https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611236)** (English version on the European Commission's website). The nine criteria and the list of what an acceptable DPIA must include (Annex 2). They aren't a form to fill in.

If you're a DPO with several clients, pick one template and use it for all of them. The EDPB's is the obvious choice, since European authorities are going to use it as their basis.

We don't have a Pulsaiq DPIA kit yet. For now, the <a href="/en/resources/record-of-processing-kit/">record of processing activities kit</a> has a "DPIA needed?" column: a good place to start working out which processing to assess first.


## The lists may become EU-wide. That isn't law yet.

The Digital Omnibus, proposed by the European Commission in November 2025 (COM(2025) 837), provides for common EU lists of processing that does, and doesn't, require an impact assessment. In the negotiating mandate it approved on 21 October 2026, the Council goes further: a single EU list would replace the national lists, and a list of exempt processing would become mandatory (recital 40 of the mandate, document 14756/26). The European Parliament hasn't adopted its position yet.

**What this means for you today:** until a final text is published in the Official Journal, the DPC's list and the European criteria in this guide still apply. The other big changes in the Omnibus are covered in our <a href="/en/blog/digital-omnibus-data-breaches-access-requests/">article on the Digital Omnibus</a>.

**What about artificial intelligence?** If you're going to use a high-risk AI system, the AI Act requires you to use the information the provider gives you to carry out your DPIA (Regulation (EU) 2024/1689, Art. 26(9)). Some deployers, such as public bodies and those using AI to assess creditworthiness, must also carry out a fundamental rights impact assessment (Art. 27). These rules apply from 2 December 2027 in the areas listed in Annex III. Our <a href="/en/blog/what-is-the-eu-ai-act/">article on the AI Act</a> explains the rest.


## Checklist: is your DPIA ready?

- You ran the processing through the three filters and recorded the result, even when the answer was no.
- The DPIA was done before the processing started.
- The description says what data, whose, for what, where it's kept, who can access it and for how long.
- You explained why there's no less intrusive way to get the same result.
- The risks are written from the point of view of the people involved, with likelihood and severity.
- Each risk has a measure, an owner and a deadline.
- The supplier gave you the technical information you needed, in writing.
- The DPO gave written advice, and the decision on that advice is recorded.
- The people affected or their representatives were consulted, or the DPIA says why that wasn't appropriate.
- The final decision has a name and date and says whether the remaining risk is high.
- If the risk is still high, prior consultation with the DPC took place before launch.
- There's a date for the next review.


## Frequently asked questions

### Does a small business have to do impact assessments?

Only for high-risk processing, and the size of the business doesn't matter. A clinic with 22 people that wants facial recognition needs a DPIA; a multinational sending a newsletter to people who asked for it doesn't need one for that processing.

### Do I have to send my DPIA to the DPC?

No. The DPIA stays with your organisation. You only send it when you make a prior consultation because the risk is still high, or when the DPC asks for it.

### Can the DPO do the DPIA?

They shouldn't. The DPIA is the controller's responsibility and the DPO advises on it (Art. 35(2) and Art. 39(1)(c)). The DPO can provide the template and follow the work, but the decision is recorded as the organisation's.

### How often do I have to review the DPIA?

The law doesn't set a period. It requires a review at least when the risks change (Art. 35(11)), and the European guidelines ask for regular reassessment. A yearly review plus one at every significant change covers both.

### Can one DPIA cover several processing operations?

Yes, if they're similar and present similar high risks (Art. 35(1)). That's useful if you run the same system across several shops, clinics or offices.

### Do I have to publish my DPIA?

It isn't mandatory. The European guidelines suggest publishing at least a summary or the conclusions, because it shows people that the risk has been thought through.

### Can I use the EDPB template now?

Yes. The EDPB encourages organisations to use it and says it isn't mandatory. It's at version 1, from April 2026, and the final version may change.


## Sources

### EU and national law

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679), Articles 6, 9, 13, 28, 35, 36 and 39 and recitals 89, 90, 91 and 94 (EUR-Lex)
- [Data Protection Act 2018 (Ireland)](https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/html), Part 3, Chapter 2 (sections 45 to 55) (Irish Statute Book)
- [Regulation (EU) 2024/1689 (AI Act)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689), Articles 26 and 27 (EUR-Lex)

### Supervisory authorities and European guidance

- [DPC, List of Types of Data Processing Operations which require a Data Protection Impact Assessment](https://www.dataprotection.ie/sites/default/files/uploads/2018-11/Data-Protection-Impact-Assessment.pdf), revised 15 November 2018
- [DPC, Data Protection Impact Assessments](https://www.dataprotection.ie/en/organisations/know-your-obligations/data-protection-impact-assessments)
- [DPC, Prior Consultation](https://www.dataprotection.ie/organisations/know-your-obligations/data-protection-impact-assessments/prior-consultation)
- [DPC, Sample DPIA Template](https://www.dataprotection.ie/sites/default/files/uploads/2024-11/Sample-DPIA-Template-EN.pdf)
- [ICO (UK), Examples of processing likely to result in high risk](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/examples-of-processing-likely-to-result-in-high-risk)
- [ICO (UK), Can we use biometric data for time and attendance control and monitoring?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/can-we-use-biometric-data-for-time-and-attendance-control-and-monitoring/)
- [Article 29 Working Party, Guidelines on Data Protection Impact Assessment (WP248 rev.01)](https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611236), revised 4 October 2017, endorsed by the EDPB
- [EDPB, news on the DPIA template](https://www.edpb.europa.eu/news/enhancing-compliance-and-consistency-edpb-adopts-dpia-template_en), 14 April 2026
- [EDPB, public consultation on the DPIA template](https://www.edpb.europa.eu/public-consultations/template-for-data-protection-impact-assessment_en), with the template and the explanatory note
- [CNIL, PIA software](https://www.cnil.fr/fr/outil-pia-telechargez-et-installez-le-logiciel-de-la-cnil)
- [CNIL, Ce qu'il faut savoir sur l'AIPD](https://www.cnil.fr/fr/ce-quil-faut-savoir-sur-lanalyse-dimpact-relative-la-protection-des-donnees-aipd) (in French)

### Changes in progress

- [European Commission, proposal COM(2025) 837](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0837), Digital Omnibus
- [Council of the EU, negotiating mandate, document 14756/26](https://data.consilium.europa.eu/doc/document/ST-14756-2026-INIT/en/pdf), 22 October 2026
- [EDPB-EDPS Joint Opinion 2/2026 on the Digital Omnibus](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf)

**Last reviewed:** 4 November 2026. We review this guide whenever the law or the authorities' guidance changes.

This guide is general information about the GDPR and isn't legal advice. For decisions on a specific case, talk to a qualified professional. The people and businesses in the examples are fictional.