Checklist: carrying out a data protection impact assessment
For: Data protection leads and project managers
Updated: 2026-11
A data protection impact assessment is produced in seven steps: check whether a high risk exists, describe the planned processing, assess risks to data subjects, define measures, judge the residual risk, consult the FDPIC or the data protection adviser if a high residual risk remains, and retain and update the assessment.
Under Art. 22 FADP a DPIA is required where processing may entail a high risk to the personality or fundamental rights of data subjects, in particular large-scale processing of sensitive data or systematic large-scale monitoring of public areas. The GDPR has a comparable duty in Art. 35.
This checklist describes the process. Where AI systems are involved, the fundamental rights impact assessment under the AI Act complements the DPIA.
The checklist
- 01
Check the duty
Assess against the criteria in Art. 22 FADP and the processing whether a high risk may exist.
Done when: The assessment is recorded in writing, even if no DPIA is required.
- 02
Describe processing
Describe purpose, data categories, data subjects, systems, recipients and transfers abroad.
Done when: The description is complete and reconciled with the record of processing.
- 03
Assess risks
Assess risks to personality and fundamental rights by likelihood and severity.
Done when: Each risk is recorded with likelihood, severity and reasoning.
- 04
Define measures
Determine technical and organisational measures that reduce the risks.
Done when: Every relevant risk has at least one measure with an owner.
- 05
Judge residual risk
After the measures, assess whether a high risk remains.
Done when: The residual risk is assessed and accepted or escalated by the responsible body.
- 06
Clarify consultation
If a high residual risk remains, consult the FDPIC; private controllers may instead consult their data protection adviser.
Done when: Consultation has taken place and is documented, or is justified as unnecessary.
- 07
Retain and update
Keep the DPIA and update it when processing changes significantly.
Done when: The DPIA is filed with a date and a next review date.
Common mistakes
- —Producing the DPIA after go-live, when measures become expensive.
- —Assessing risks to the organisation instead of to data subjects.
- —Naming measures without assigning them.
- —Never updating the DPIA although processing changes.
What this checklist does not cover
- —The checklist does not replace legal assessment in individual cases.
- —Sector-specific rules, for example in healthcare, may add requirements.
- —For AI systems a fundamental rights impact assessment under the AI Act may also be required.
Parent service: Data Protection Consulting
Matching offers
FRIA & DPIA for AI systems
This package produces the impact assessments an AI system often needs simultaneously: the fundamental rights impact assessment (FRIA) under Article 27 of the AI Act and the data protection impact assessment (DPIA) under Article 35 GDPR — integrated rather than duplicated, as one audit-ready assessment with a clear approval decision.
revFADP implementation for SMEs: from status quo to evidence
A bounded package that takes a Swiss SME from uncertainty to a documented state: capture data flows and providers, determine obligations, review contracts and international transfers, provide privacy-policy groundwork and set clear procedures for data breaches and access requests.
FAQ
How long must the DPIA be kept?
Under the Data Protection Ordinance, at least two years after processing ends.
Who produces the DPIA?
The controller, usually the project lead with support from data protection leads and IT.
Is there a template?
Templates help with structure. The value comes from concretely describing and assessing your own processing.
More checklists
Checklist: reviewing a privacy notice under the FADP and GDPR
A privacy notice is reviewed in seven steps: controller and contact, purposes of processing, data categories, recipients and processors, transfers abroad with safeguards, data subject rights and currency against the services actually used. Anyone also targeting people in the EU adds the additional GDPR information.
Checklist: implementing cookies and consent correctly
Cookies are implemented correctly in seven steps: inventory all cookies and trackers, separate necessary from optional, determine the rules for your audience, in Switzerland inform users and allow refusal, for EU visitors set optional cookies only after consent, enforce the choice technically and review regularly.
Checklist: SEO migration in a website relaunch
Visibility is kept in a relaunch in seven steps: record all existing URLs and their performance, redirect every old URL to the matching new one, carry over strong content rather than replacing it, migrate metadata and structured data, test on staging, update sitemap and Search Console after go-live and monitor for weeks.