Why DPIA matters now
Privacy is no longer a checkbox handled during the GDPR sprint of 2018. Supervisory authorities across the EU and the Swiss FDPIC have moved decisively into enforcement mode, with multi-million-Euro fines now routine and the first wave of collective actions under way. For any company operating in the DACH region, DPIA is a recurring operational requirement, not a one-time project.
Core concepts you need to hold straight
Before going into implementation, it's worth fixing the vocabulary. A surprising amount of the practical confusion around when do you need a dpia, and how do you run one? comes from people using the same words to mean different things. Here are the definitions we work with internally at Innopulse:
Dpia — in the context of when do you need a dpia, and how do you run one?, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
Article 35 gdpr — in the context of when do you need a dpia, and how do you run one?, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
Datenschutz-folgenabschätzung — in the context of when do you need a dpia, and how do you run one?, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
Fria ai act — in the context of when do you need a dpia, and how do you run one?, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
How to actually do this
The move from reading about when do you need a dpia, and how do you run one? to actually implementing it is where most SMEs stall. In our experience, the blockage is rarely capability — it's sequencing. Attempting to do everything in parallel burns out the small team that's responsible; attempting to do it in the wrong order means early work has to be redone.
The mistakes that slow everyone down
The first is scope creep disguised as ambition. A project scoped to address when do you need a dpia, and how do you run one? gradually expands to address everything adjacent. By month three, the original deliverable is two quarters away and the team has lost focus. The fix is ruthless: write down what's out of scope as explicitly as what's in.
What we actually do internally
On when do you need a dpia, and how do you run one? specifically, our internal practice has evolved considerably. The early version was manual, error-prone, and didn't scale past three products. The current version is partly automated, documented in runbooks, and survives the addition of new products without degradation.
What this means for the DACH landscape
Stepping back from the immediate operational picture, when do you need a dpia, and how do you run one? points at some broader shifts in how Swiss and DACH firms are going to operate over the next 24–36 months.
The takeaway
If you're reading this because you have an active project around when do you need a dpia, and how do you run one?, here are the next steps we'd suggest — based on where most SMEs we work with are starting from.
Either way: pick your first step, put a calendar date on it, and start.