When is a data protection impact assessment (DPIA) required?
Short answer
An assessment is required when the processing is likely to result in a high risk to people's rights and freedoms. In practice, the most common cases are video surveillance, call recording, systematic monitoring of employees, and large-scale processing of special category data.
On this page
1.How to recognise high risk
High risk usually arises when several factors coincide: the processing is systematic, covers a large number of people, takes place in a publicly accessible area, affects vulnerable individuals, uses new technology, or leads to decisions with legal effects. One factor alone does not yet create an obligation, but two or three together are already a serious sign.
The supervisory authority publishes a list of processing types for which an assessment is mandatory. Before starting a new process, it is worth checking that list; for the list and its source, see Article 35(4) GDPR; the list is Order No. 1T-35 (1.12.E) of the Director of the State Data Protection Inspectorate of 14 March 2019.
2.Most common cases
Video surveillance of premises and grounds is the most common case, especially when the cameras cover entrances, workstations, or a high volume of foot traffic. The second common case is recording phone calls, because it affects both customers and employees, and the recordings often end up containing data nobody planned to collect.
Next come tools that monitor employee activity, large-scale processing of health data, and automated evaluation used to make decisions about a person. If an organisation deploys an AI tool that evaluates people, an assessment is almost always required.
3.What the assessment must cover
The assessment describes the planned activity and its purpose, evaluates its necessity and proportionality, lists the risks to individuals, and sets out measures to reduce those risks. It is not a formal questionnaire — the most valuable part is an honest answer to whether the purpose can be achieved in a less intrusive way.
The assessment is carried out before the activity begins. If the cameras are already running, the assessment is still carried out, but it then often ends in a decision to change the zones, the retention period, or access rights — which costs more than doing it upfront would have.
4.What comes next
If, after all the measures, the risk remains high, you must consult the supervisory authority before starting the activity. In practice this is rare: most risks are reduced through narrower surveillance zones, shorter retention periods, and stricter access controls.
The assessment is not a one-off exercise. When the scope changes — more cameras, a new system, a new purpose — it needs to be reviewed. It is useful to record the review date alongside the assessment.
Official legal text
We do not paraphrase the regulation's provisions here. The official Lithuanian text of the GDPR is available in one place and is more precise than any summary.
GDPR text in Lithuanian (EUR-Lex)