How do we carry out a data protection impact assessment step by step?
Short answer
A data protection impact assessment (DPIA) is six written steps: describe the processing, justify that it is necessary, list the risks to people, choose measures, assess the remaining risk and take a decision. Article 35(7) GDPR sets four mandatory parts; below they are shown with one example you can transfer to your own process.
On this page
1.The example used throughout
A transport or services company with 25 cars wants to install GPS tracking. The purposes are route planning, fuel-cost control and protecting the cars from theft. Employees drive the cars.
Is a DPIA needed? Yes. Point 10 of the list approved by the State Data Protection Inspectorate (VDAI) by order No. 1T-35 (1.12.E) of 2019-03-14 covers processing linked to monitoring employees' location or movement. When a DPIA is needed in general is explained in a separate answer (in Lithuanian).
The key rule: the DPIA is done before processing starts (Article 35(1) GDPR). The GPS stays off for now.
2.Step 1. Describe the processing systematically
Article 35(7)(a) GDPR. Write it so that someone who has never seen the system understands it:
| Question | Answer in the example |
|---|---|
| Which data? | Car location, speed, route, time; driver name through car assignment |
| Whose? | 25 employees who drive company cars |
| How long is it kept? | Working-hours routes – 3 months; off-hours data – 72 hours; fuel reports – per accounting retention |
| Who sees it? | Logistics manager; the managing director only after an incident |
| Who supplies the system? | GPS service provider, a processor, servers in the EU |
| Purposes | Route planning, fuel control, locating a stolen car |
| Legal basis | The company's legitimate interest |
3.Step 2. Assess necessity and proportionality
Article 35(7)(b) GDPR. This is where an assessment can change the plan. Ask for each purpose: can it be achieved in a less intrusive way?
- Route planning – location during working hours is enough. There is no need to track outside working hours.
- Fuel control – mileage and fuel-card data are enough; the exact route is not needed.
- Theft – location is needed only after a theft, not every day, but thefts usually happen outside working hours.
Conclusion in the example: during working hours location is shown to the logistics manager; outside working hours it is shown to nobody, kept for only 72 hours and opened only after a theft is reported – by the managing director, with the opening logged; if there is no theft, off-hours data is deleted automatically; speed data is not collected, because no purpose needs it. This applies the data minimisation principle in Article 5(1)(c) GDPR; whether it is enough, you assess for your own case.
4.Step 3. List the risks to people
Article 35(7)(c) GDPR. Risk is assessed for the person, not for the company. For each risk: likelihood and severity.
| # | Risk to the employee | Likelihood | Severity | Level |
|---|---|---|---|---|
| 1 | Tracking outside working hours reveals private life | Medium | High | High |
| 2 | Data is used to assess the employee without their knowledge | Medium | Medium | Medium |
| 3 | Too many people see routes | Medium | Medium | Medium |
| 4 | Leak from the supplier's system | Low | Medium | Low |
| 5 | Data kept longer than needed | High | Low | Medium |
5.Step 4. Choose a measure for each risk
Article 35(7)(d) GDPR. Each measure is linked to a risk in the table:
| Risk | Measure |
|---|---|
| 1 | Outside working hours location is shown to nobody, kept for only 72 hours and opened only after a reported theft, with a log entry |
| 2 | The employee notice states clearly what the data is used for and what it is not used for; employees are informed against signature or in another provable way (Article 5(4) of the Law on the Legal Protection of Personal Data) |
| 3 | Access only for the logistics manager; access log |
| 4 | Data processing agreement with the supplier; servers in the EU; two-factor login |
| 5 | Working-hours routes deleted automatically after 3 months; off-hours data after 72 hours |
Article 35(9) GDPR requires the controller, where appropriate, to seek the views of the people concerned or their representatives. In the example this is simple: a short meeting with the drivers before installing the system, and a note of their comments.
Works council. The example company has 25 employees. An employer with on average 20 or more employees must inform and consult the works council before approving rules on monitoring employees at the workplace, and must inform it 10 working days in advance (Article 206(1)(5) of the Labour Code; the 10 days – paragraph 2 of the same article). If there is neither a works council nor an employee trustee performing its functions, the information goes to a trade union operating at employer level, if there is one (Article 206(4) of the Labour Code).
6.Step 5. Assess the remaining risk
Repeat the risk table with the measures in place. In the example, risk 1 becomes low, because nobody sees location outside working hours without a reported theft. Risks 2, 3 and 5 (after automatic deletion) become low; 4 stays low. Remaining risk: low.
If, after the measures, the risk remains high, Article 36(1) GDPR requires you to consult VDAI before starting. If the inspectorate considers that the processing would infringe the GDPR, it gives written advice within 8 weeks; in complex cases this can be extended by 6 more weeks (Article 36(2)).
7.Step 6. Record the decision and a review date
At the end of the assessment – one page:
- Conclusion: processing may start with the measures from step 4.
- Who approved it and when.
- Who is responsible for each measure.
- Review date. Article 35(11) GDPR: where necessary, the assessment is reviewed, at least when the risk changes. In the example: when the supplier or the system's features change. Using GPS to assess staff would be a new purpose – that needs a new assessment and a new notice to employees.
Then hand the notice to employees against signature or in another provable way, and only after that switch the GPS on.
8.How to transfer it to your process
The same six-step frame works for other processes on the VDAI list: workplace video surveillance, telephone call recording, biometric access control. Only the tables change. Step 2 needs the most attention, because that is where you may find out that part of the data is not needed.
9.What to do next
Fill in the step 1 table today – you know half the answers. With the tool (in Lithuanian) you can see free of charge which of your processes are risky and may need an assessment. An impact assessment can also be ordered as a one-off procedure: €95 excl. VAT per process.
10.Frequently asked questions
How long does a DPIA take?
The GDPR sets no deadline. It depends on the process and on how quickly you collect the information; how long it takes in practice is described in the dat.lt article (link below).
Can one DPIA cover several processes?
Yes, if they are similar operations with similar high risks. Article 35(1) GDPR allows one assessment for such a set.
Do we send the DPIA to VDAI?
No, unless the remaining risk is high. You keep the assessment and produce it on request. VDAI is consulted only when high risk remains (Article 36(1) GDPR).
Do we need a DPIA if GPS is already installed?
Yes. Do it now, and if it turns out part of the data is not needed, cut it at once.
11.Related questions
- When is a data protection impact assessment (DPIA) needed? (in Lithuanian)
- How to carry out a legitimate interest balancing test? (in Lithuanian)
- Employee privacy notice: how to prepare it
The law and the risk: Data protection impact assessment: what it consists of, how long it takes and how much work it will ask of you – dat.lt
12.Legal sources
- Assessment before processing; one assessment for similar operations – Article 35(1) GDPR.
- Four mandatory parts – Article 35(7)(a) to (d) GDPR.
- Views of the people concerned – Article 35(9) GDPR; review when the risk changes – Article 35(11).
- Prior consultation with VDAI and time limits – Article 36(1) and 36(2) GDPR.
- Data minimisation and storage limitation – Article 5(1)(c) and 5(1)(e) GDPR.
- Employee location or movement monitoring on the list – VDAI Director's order No. 1T-35 (1.12.E) of 2019-03-14, list point 10.
- Informing employees against signature about workplace monitoring – Article 5(4) of the Law on the Legal Protection of Personal Data (ADTAĮ).
- Informing and consulting the works council on monitoring rules – Article 206(1)(5) of the Labour Code, with paragraphs 2 and 4 of the same article.
GDPR read from the official consolidated English text (02016R0679, 04.05.2016). VDAI order – Register of Legal Acts text, unamended since adoption. Labour Code – e-tar.lt consolidated version from 2026-06-07. ADTAĮ – Register of Legal Acts, consolidated version from 2026-06-30; English wording of Lithuanian provisions is our translation. This text is general information and is not individual legal advice.
Official legal text
We do not paraphrase the regulation's provisions here. The official Lithuanian text of the GDPR is available in one place and is more precise than any summary.
GDPR text in Lithuanian (EUR-Lex)