Overview
Article 35(11) GDPR requires controllers to carry out reviews of DPIAs "at least when there is a change in the risk represented by processing operations." Effective DPIA register management ensures that all assessments are tracked, reviewed on schedule, and updated when processing changes. The register serves as the central accountability record demonstrating that the controller has systematically identified and assessed high-risk processing across the organisation.
Register Structure
Core DPIA Record Fields
| Field | Description | GDPR Reference |
|---|---|---|
| DPIA Reference | Unique identifier (format: DPIA-[DEPT]-[YEAR]-[SEQ]) | Art. 5(2) Accountability |
| Processing Activity | Name and description of the processing operation assessed | Art. 35(7)(a) |
| RoPA Reference | Link to Records of Processing Activities entry | Art. 30 |
| Controller / Joint Controller | Responsible data controller(s) | Art. 35(1) |
| DPO Consulted | Confirmation DPO was consulted per Art. 35(2) | Art. 35(2) |
| Assessment Date | Date DPIA was completed | Art. 5(2) |
| DPIA Lead | Person who conducted the assessment | Accountability |
| Status | Draft, In Review, Approved, Requires Update, Archived | Art. 35(11) |
| Overall Risk Level | Residual risk level after mitigation (Low/Medium/High/Very High) | Art. 35(7)(c)-(d) |
| Prior Consultation | Whether Art. 36 prior consultation was required and outcome | Art. 36 |
| Review Date | Next scheduled review date | Art. 35(11) |
| Review Trigger | Event that will trigger early reassessment | Art. 35(11) |
| Linked Mitigation Plan | Reference to the mitigation plan document | Art. 35(7)(d) |
| Approval Authority | Senior management or board member who approved | Art. 24 |
DPIA Lifecycle States
[Screening] ──► [Draft] ──► [DPO Review] ──► [Approved]
│
┌─────────────┤
│ │
[Requires Update] [Active Monitoring]
│ │
└─► [Revised] ─► [Re-approved]
│
[Archived]
Screening: Processing activity identified as potentially requiring DPIA; threshold assessment conducted.
Draft: DPIA being prepared; processing description, necessity assessment, and risk assessment in progress.
DPO Review: Complete draft submitted to DPO for Art. 35(2) advice.
Approved: DPIA reviewed, DPO advice incorporated, residual risk accepted, processing may commence.
Active Monitoring: Approved DPIA with ongoing mitigation tracking and periodic review.
Requires Update: Triggered by processing change, incident, or scheduled review.
Revised: Updated DPIA addressing changes or new risks.
Re-approved: Revised DPIA reviewed and approved.
Archived: Processing ceased; DPIA retained for accountability records per retention policy.
Review Scheduling
Art. 35(11) Periodic Review Requirements
The GDPR does not specify a fixed review frequency. The EDPB recommends that DPIAs be reviewed "at least when there is a change in the risk represented by processing operations." Organisational best practice establishes:
| Risk Level | Review Frequency | Rationale |
|---|---|---|
| Very High (with Art. 36 consultation) | Every 6 months | Highest risk requires most frequent reassessment |
| High | Annually | Significant risk warrants annual review |
| Medium | Every 18 months | Moderate risk with standard review cycle |
| Low | Every 24 months | Lower risk allows extended review cycle |
Change-Triggered Review Events
Regardless of scheduled review, a DPIA must be reassessed when:
- Processing scope changes: New data categories, new data subjects, expanded geographic scope
- Technology changes: New system, vendor change, algorithm update, infrastructure migration
- Legal/regulatory change: New legislation, supervisory authority guidance, court ruling
- Incident or breach: Data breach affecting the assessed processing activity
- Organisational change: Merger, acquisition, new controller, new processor
- Data subject complaint: Pattern of complaints about the assessed processing
- Audit finding: Internal or external audit identifies DPIA gap
- DPO recommendation: DPO identifies emerging risk or changed context
Supervisory Authority Reporting
Art. 35(1) Documentation Obligation
The DPIA register must be available for inspection by the supervisory authority upon request. Key reporting elements:
- Complete list of all DPIAs conducted with dates and outcomes
- Status of each DPIA (current, requires update, archived)
- Art. 36 prior consultation records and supervisory authority responses
- Evidence of Art. 35(11) periodic reviews conducted on schedule
- DPO consultation records for each DPIA
Art. 36 Prior Consultation Tracking
For DPIAs that triggered prior consultation, the register tracks:
| Field | Description |
|---|---|
| Submission Date | When the DPIA was submitted to the supervisory authority |
| SA Reference | Supervisory authority's case reference number |
| Response Date | When the SA responded |
| SA Outcome | Approved, approved with conditions, objected |
| Conditions | Any conditions imposed by the SA |
| Compliance Status | Whether conditions have been met |
Integration Points
- DPIA Risk Scoring: Risk methodology feeding into register risk levels (see dpia-risk-scoring skill)
- DPIA Mitigation Plan: Linked mitigation plans tracked in register (see dpia-mitigation-plan skill)
- DPIA Stakeholder Consult: Consultation records linked to DPIA entries (see dpia-stakeholder-consult skill)
- GDPR Accountability: Register serves as key accountability evidence (see gdpr-accountability skill)
- Automated ROPA Generation: RoPA entries linked to DPIA register (see automated-ropa-generation skill)