DPIA — data protection impact assessment in Romania (Article 35 GDPR)

A DPIA is one of the most important operational obligations in the GDPR. When a company plans processing that is likely to result in a high risk to people’s rights, the assessment is not optional: it is required by Article 35 GDPR, and in Romania ANSPDCP has published the list of operations for which it is mandatory.

What a DPIA is, and the legal basis

A DPIA is a structured analysis, documented in writing, of the risks a processing operation may pose to the rights and freedoms of the people whose data is processed. Its purpose is to identify those risks before processing starts and to put mitigating measures in place.

The legal basis is Article 35 GDPR, together with Article 36 on prior consultation. Under Article 35(4), each supervisory authority publishes a list of operations that require a DPIA. Romania’s is ANSPDCP Decision no. 174/2018, published in the Official Gazette no. 919 of 31 October 2018. Beyond the list, the European guidelines (WP248, endorsed by the EDPB) treat processing that meets two or more of their nine criteria — evaluation or scoring, automated decisions, systematic monitoring, sensitive data, large scale, combined datasets, vulnerable people, new technology, preventing people from exercising a right — as likely to require one.

When it is mandatory — the ANSPDCP list

Article 1 of Decision no. 174/2018 makes a DPIA mandatory in particular for:

• a) Evaluation and profiling behind significant decisions

  Systematic and extensive evaluation of personal aspects, based on automated processing including profiling, on which decisions are based that produce legal effects or similarly significantly affect the person — credit scoring, automated recruitment screening.

• b) Special categories on a large scale

  Large-scale processing of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data for unique identification, health data, data on sex life or sexual orientation, or data on criminal convictions and offences.

• c) Monitoring publicly accessible areas

  Systematic large-scale monitoring of a publicly accessible area, such as video surveillance in shopping centres, stadiums, markets and parks.

• d) Vulnerable persons, including employees

  Large-scale processing of data of vulnerable persons, in particular minors and employees, through automated monitoring or systematic recording of behaviour, including for advertising and marketing.

• e) New technologies

  Large-scale processing through the innovative use or implementation of new technologies, in particular where it limits people’s ability to exercise their rights — for example facial recognition to grant access to premises.

• f) Connected devices

  Large-scale processing of data generated by sensor devices that transmit data over the internet or otherwise: smart TVs, connected vehicles, smart meters, smart toys, smart cities.

• g) Traffic and location data

  Large-scale or systematic processing of traffic or location data — Wi-Fi tracking, geolocation of public transport passengers — where it is not needed to provide a service the person requested.

Point d) matters for every employer: automated monitoring of employees’ behaviour on a large scale is on the list. The Decision also exempts processing based on a legal obligation or a task in the public interest where a DPIA was already carried out when the legal basis was adopted.

The process, step by step

1. 1
   A systematic description of the processing

   The purposes, the categories of data and of people concerned, the recipients, retention periods, transfers outside the EU and the systems used. Everything that follows rests on this; an incomplete description undermines the whole assessment.

2. 2
   Necessity and proportionality

   Is the processing actually needed for the stated purpose? Is the data limited to what is necessary? Is there a less intrusive way to reach the same purpose? The answers are documented.

3. 3
   Risks to individuals

   For each risk: its likelihood and its severity for the people concerned. Typical risks are unauthorised access, alteration, loss or disclosure, and discrimination or exclusion resulting from the processing.

4. 4
   Measures to address the risks

   Technical measures (encryption, pseudonymisation, access control, logging) and organisational ones (policies, training, periodic review). Each identified risk is matched with a measure, or a combination, that reduces its likelihood or severity.

5. 5
   Prior consultation, where needed

   If a high risk remains after the measures, ANSPDCP is consulted under Article 36 before the processing starts. The authority answers in writing within up to eight weeks, extendable by six.

Article 35(2) requires the controller to seek the advice of the DPO, internal or outsourced, when carrying out the assessment; that advice belongs in the DPIA file. Where appropriate, the views of the people concerned or their representatives are sought as well.

The DPIA and the AI Act

The AI Act introduces a related but distinct assessment: the fundamental rights impact assessment (FRIA) in Article 27. It is narrower in who must do it than is often assumed. It applies to deployers of high-risk systems that are bodies governed by public law or private entities providing public services, and to deployers of systems used to assess creditworthiness or to price life and health insurance. It applies with the Annex III obligations, from 2 December 2027.

The difference in substance: the DPIA looks at risks arising from the processing of personal data; the FRIA looks at the wider range of fundamental rights — non-discrimination, dignity, access to services. Article 27(4) provides that where a DPIA already covers some of the obligations, the FRIA complements it.

Example: a bank deploying an AI credit scoring system needs a DPIA under Article 35 GDPR (point a) of the ANSPDCP list) and a FRIA under Article 27 AI Act. Done as one exercise, the two avoid duplicated work and contradictory conclusions. A private employer using an AI recruitment tool, by contrast, needs a DPIA but not, as such, a FRIA.

Common mistakes

• A DPIA carried out after processing started

  The most serious error. The assessment has to come before the processing; afterwards it no longer serves its preventive purpose.

• An incomplete description

  Missing data categories, recipients left out (sub-processors, third parties), vague retention periods. The description should allow an outside reviewer to understand the operation in full.

• A form filled in without analysis

  Ticked boxes and templates used without adapting them to the actual processing. A DPIA has to show the reasoning, not only the conclusion.

• No DPO advice on file

  Article 35(2) requires it. A DPIA without the DPO’s advice is incomplete on its face.

• No prior consultation when it was required

  If a high risk remains, consulting ANSPDCP before starting is an obligation of its own; starting without it is a separate breach.

• No review

  A DPIA is not static. It is reviewed when the processing, the technology or the risk changes (Article 35(11)).

Internal or external

A DPIA can be done in-house where the company has a qualified DPO and experience of risk assessment. For most small and medium companies, an assessment needed occasionally is more efficiently done with outside support than by training someone for it. For foreign groups, the Romanian list is the point to check: a group DPIA template built on another authority’s list may miss points d) and g).

Frequently asked questions