How to Carry Out a GDPR DPIA in Italy (2026): Step‑by‑step Requirements & Checklist

GDPR DPIA Italy obligations have moved to the centre of supervisory attention in 2026, as both the European Data Protection Board and the Italian Garante sharpen their expectations for how organisations assess and mitigate high‑risk processing, above all where artificial intelligence is involved. This guide sets out a practical, inspection‑ready data protection impact assessment process tailored to Italian practice, drawing directly on Article 35 of the GDPR, EDPB methodology and Garante guidance. It is written for in‑house counsel, Data Protection Officers (DPOs), privacy managers and compliance leads who need a workable playbook rather than a restatement of the law.

You will find the statutory triggers, a numbered step‑by‑step procedure with owners and durations, the documents an assessment must contain, realistic cost bands, and the mistakes that most often surface during a Garante inspection.

Overview, What a data protection impact assessment is and why it matters in Italy

A data protection impact assessment (DPIA) is a structured process for identifying, evaluating and mitigating the risks that a given processing activity poses to the rights and freedoms of individuals. Its legal basis sits in Article 35 of the GDPR (Regulation (EU) 2016/679), which requires a controller to carry out an assessment prior to processing where that processing is likely to result in a high risk. In Italy, the GDPR is supplemented by the Codice Privacy (Decreto Legislativo 196/2003, as amended by D.lgs. 101/2018), and supervised by the Garante per la protezione dei dati personali.

The DPIA is not a one‑off administrative hurdle. It is a living risk‑management tool and, in practical terms, a key line of defence during a regulatory inspection. A well‑documented gdpr dpia italy file demonstrates that the controller identified risks early, considered proportionality, implemented concrete safeguards and secured senior accountability, exactly the posture the Garante expects to see.

What DPIAs achieve

• Legal compliance. They satisfy the Article 35 obligation and, where risk cannot be reduced, trigger the prior consultation duty under Article 36.
• Risk mitigation. They force a disciplined analysis of technical and organisational measures before processing begins, when change is cheapest.
• Inspection readiness. They produce the evidence the Garante requests, data flows, risk scoring, consultation records and sign‑off, in one coherent file.

The 2026 context matters. Supervisory authorities across the EU, including the Garante, have signalled heightened scrutiny of AI and other high‑risk processing, with a particular interest in automated decision‑making, profiling and biometric systems. For those use cases, a generic assessment is less likely to withstand examination.

Eligibility, When is a DPIA required under GDPR in Italy

The threshold question is whether processing is “likely to result in a high risk to the rights and freedoms of natural persons” (Art. 35(1) GDPR). Where it is, a DPIA is mandatory before processing starts. The EDPB guidelines (originally adopted by the Article 29 Working Party and endorsed by the EDPB) provide criteria for identifying high risk, and the Garante has published Italy‑specific indications and lists to assist controllers.

Statutory triggers (Art. 35 GDPR)

Article 35(3) sets out three cases where a DPIA is always required:

• Systematic and extensive evaluation. A systematic and extensive evaluation of personal aspects relating to natural persons based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the individual.
• Large‑scale special categories. Processing on a large scale of special categories of data (Art. 9) or personal data relating to criminal convictions and offences (Art. 10).
• Systematic monitoring of a publicly accessible area on a large scale. This captures many CCTV and video‑surveillance deployments.

The EDPB’s criteria widen the practical scope: evaluation or scoring, automated decision‑making with legal or similar significant effect, systematic monitoring, sensitive data or data of a highly personal nature, data processed on a large scale, matching or combining datasets, data concerning vulnerable subjects, innovative use or application of new technological or organisational solutions, and processing that prevents data subjects from exercising a right or using a service or contract. Where two or more of these criteria are met, a DPIA should ordinarily be carried out.

Garante examples & thresholds

The Garante (garanteprivacy.it) has adopted a list of processing types that are subject to the DPIA requirement under Italian supervision. These typically cover areas such as large‑scale profiling, systematic biometric processing for unique identification, large‑scale geolocation, processing of vulnerable individuals’ data, and the use of innovative technologies. Controllers operating in Italy should consult the current Garante list before concluding that no assessment is needed, because the national list operates alongside, not instead of, the EDPB criteria.

When a DPIA is NOT required

Not every processing activity needs a full assessment. Where a screening shows low or minimal risk, a short reasoned record suffices. A DPIA is generally not required where processing is not likely to result in a high risk, where a comparable processing operation has already been the subject of a DPIA, or where the processing falls within an “exempt” list that the Garante may publish under Art. 35(5). In all such cases, document why you concluded no DPIA was needed, that reasoning is itself inspection evidence.

Step‑by‑step DPIA process, how to do a gdpr dpia italy assessment

The following is the core operational playbook. Each step lists the responsible owner, the output produced and an estimated duration. Treat the durations as planning guidance for a moderately complex project; simple screenings compress and AI projects extend. Where evidence must be captured for a potential inspection, a callout flags it.

1. Step 0, Pre‑screening / risk screening. Before committing resources, run a short screening against the Art. 35(3) triggers, the EDPB criteria and the Garante list. Output: a screening form recording the decision to proceed to a full DPIA, to keep a screening record only, or to note “no DPIA required” in the records of processing. Inspection‑ready: Document this, the screening form and its rationale.
2. Step 1, Describe the processing and its context. Capture the who, what, why and how: categories of data and data subjects, purposes, recipients, retention periods, data flows, international transfers and the systems involved. A data flow map is essential. Required fields include the controller/processor roles, the lawful basis under Art. 6 (and Art. 9 conditions where relevant), and the scale and geography of processing.
3. Step 2, Assess necessity and proportionality. Map each processing purpose to its lawful basis and test whether the data collected is adequate, relevant and limited to what is necessary (data minimisation). Document whether a less intrusive alternative could achieve the same purpose. This is where many assessments are weakest and where the Garante probes hardest.
4. Step 3, Identify and evaluate risks to data subjects. Using a risk‑scoring template, identify risks (unauthorised access, excessive retention, loss of control, discrimination, re‑identification) and score each on likelihood and severity. Produce a scored risk register that distinguishes inherent risk from residual risk after controls. Inspection‑ready: Document this, the scoring methodology and the risk register.
5. Step 4, Identify and describe mitigation measures. For each material risk, specify technical and organisational measures: encryption, pseudonymisation, access controls, retention limits, logging, DPA clauses, and training. Each measure needs a named owner and an implementation date recorded in a mitigation action log.
6. Step 5, Consult stakeholders and document the consultation. Seek the advice of the DPO (mandatory where one is appointed, Art. 35(2)) and, where appropriate, the views of data subjects or their representatives (Art. 35(9)). Record HR, security, business and vendor input. Inspection‑ready: Document this, consultation notes and the DPO’s advice.
7. Step 6, AI / high‑risk specific checks. For AI and other high‑risk processing, extend the assessment to cover model explainability, bias and fairness testing, training‑data provenance, robustness and accuracy, and the design of meaningful human oversight (human‑in‑the‑loop). Record the test results and the thresholds applied.
8. Step 7, DPIA conclusion and residual risk determination. State clearly whether residual risk is acceptable. Use explicit conclusion language, for example: “After implementing the measures in the action log, the residual risk to data subjects is assessed as low/medium and is considered acceptable for processing to proceed,” or, where it is not, “Residual risk remains high; prior consultation with the Garante under Art. 36 is required before processing.”
9. Step 8, Sign‑off, recordkeeping and publication where appropriate. Obtain documented approval from the DPO, the head of the processing function and a senior executive for high‑risk decisions. Store the signed DPIA with the records of processing (RoPA). Publication of a summary is optional but can support transparency.
10. Step 9, Integrate findings into contracts and vendor diligence. Reflect DPIA conclusions in Data Processing Agreements (DPAs), supplier audits and procurement decisions so that identified controls bind the parties who actually perform the processing.
11. Step 10, Set a review schedule and maintain the audit trail. Review as necessary, and at least when there is a change of the risk represented by the processing operations (Art. 35(11)); a periodic review (for example annually) is good practice. Maintain version control and a change log so the evolution of the assessment is traceable.

DPIA step timeline, who does what and how long it takes

DPIA vs screening vs no DPIA

Required documents for a gdpr dpia italy file

A downloadable DPIA checklist and two templates, a short screening form and a full DPIA report outline, accompany this guide. Use the screening form at Step 0 and the full template from Step 1 onward so that every mandatory field is captured consistently across projects.

Required documents & sign‑off: what a DPIA report must include and who signs it

Under Art. 35(7) GDPR a DPIA must contain at least: a systematic description of the envisaged processing operations and the purposes of the processing (including, where applicable, the legitimate interest pursued); an assessment of the necessity and proportionality of the processing in relation to those purposes; an assessment of the risks to the rights and freedoms of data subjects; and the measures envisaged to address those risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance. In practice, add the consultation record, the DPIA conclusion with the residual‑risk determination, and an action plan with owners and dates.

On sign‑off, Italian corporate practice distinguishes between the function that owns the commercial decision and those providing assurance. A common approach is for the DPO (where appointed) to provide advice and monitor compliance; the head of the processing function or project sponsor to own the operational decision; and a senior executive to formally approve genuinely high‑risk processing. Note that accountability under the GDPR rests with the controller: the DPO advises but does not “sign off” in the sense of assuming the controller’s responsibility. Retain the signature page and approval records in the RoPA so the accountability chain is demonstrable.

Timeline & deadlines, how long a DPIA takes and when to review it

Using the step timeline above, a straightforward assessment can be completed in a matter of days, while a complex or AI‑driven project typically runs four to eight weeks once stakeholder consultation and technical testing are factored in. Crucially, the DPIA must be carried out prior to the processing (Art. 35(1)), it is a prior assessment, not a retrospective justification.

Review when necessary, and at least when there is a change of the risk represented by the processing operations (Art. 35(11)); a periodic review, for example annually, is widely recommended as good practice. Trigger a review on any material change: a new data source, a new vendor, a change of purpose or a retrained AI model. For models that retrain frequently, align the DPIA review cadence to the retraining schedule rather than to the calendar. Bear in mind that a Garante inspection may look back over past processing, so the audit trail should remain intact and retrievable for historic versions of the assessment.

Costs & fees, typical DPIA costs for SMEs and larger organisations

The figures below are indicative estimates for Italy and will vary significantly with scope, sector and complexity. AI, cross‑border transfers and multi‑vendor environments are the main cost drivers. They are provided for planning purposes only and should be validated against current market quotes.

Note that where residual risk remains high and prior consultation with the Garante is required under Art. 36, there is no filing fee, but the internal time and legal cost of preparing and responding to the consultation can be significant, which is a further reason to resolve risk through mitigation wherever possible.

What changes in 2026, Garante & EDPB expectations and the AI focus

The clearest shift for 2026 is the intensified supervisory focus on AI and other high‑risk processing. The EDPB and the Garante increasingly expect granular documentation around automated decision‑making and profiling: evidence of model explainability, bias and fairness testing, data‑quality and provenance controls, and the design and effectiveness of human oversight. A gdpr dpia italy file for an AI system that merely asserts “appropriate safeguards are in place” without test results and oversight design is unlikely to satisfy an inspector.

Organisations should also track the interface between data protection law and the broader EU AI regulatory framework. The EU AI Act (Regulation (EU) 2024/1689) is being phased in, with obligations applying on a staggered timetable through 2025 and beyond, and deployers of certain high‑risk AI systems may be required to carry out a fundamental rights impact assessment that can be coordinated with a DPIA. The practical effect is that the DPIA increasingly becomes a hub document linking privacy risk to AI governance, so build that linkage in now rather than retrofitting it later. Monitor current EDPB guidance and Garante statements for the latest expectations.

Common pitfalls and how to avoid them

• Insufficient scope. Assessing a single system when the real risk sits in the end‑to‑end data flow. Map the whole lifecycle, including transfers and deletion.
• Weak vendor due diligence. Treating DPAs as boilerplate. Map each supplier’s controls to specific DPIA findings and verify them through audits.
• Poor documentation of decisions. Recording conclusions but not the reasoning. The Garante wants to see why a risk was accepted, not just that it was.
• No DPO involvement. Omitting the DPO’s advice where one is appointed is inconsistent with Art. 35(2) and undermines the file’s credibility.
• Not linking the DPIA to a lawful basis. Failing to map each purpose to Art. 6 (and Art. 9 where relevant) leaves the necessity analysis unanchored.
• Generic mitigation. Copy‑pasted safeguards that do not address the specific risks identified in the register.
• Not updating after changes. Leaving a stale DPIA in place after a new model, vendor or purpose is introduced.

Conclusion

A disciplined gdpr dpia italy process is now both a legal obligation and a practical shield against the sharper enforcement environment of 2026. By screening early, describing processing precisely, testing necessity and proportionality, scoring risks honestly, designing targeted mitigations and securing documented approval, you build a file that can withstand a Garante inspection and genuinely protects data subjects. For AI and other high‑risk processing, raise the bar further with explainability, bias testing and demonstrable human oversight. Treat the DPIA as a living document, review it on material change (and periodically as good practice), and integrate its findings into your contracts and vendor diligence.

Organisations that embed these habits will find that each successive gdpr dpia italy assessment becomes faster, more defensible and more valuable as a governance asset.

For tailored support, see the Italy, Data Protection practice page and find Data protection lawyers in Italy. Further resources on GDPR compliance services, GDPR transfers and DPIA interplay, and DPIA templates and worked examples are being published as part of this cluster.

Sources

1. Regulation (EU) 2016/679 (GDPR), consolidated text
2. European Data Protection Board (EDPB), Guidelines & DPIA resources
3. Garante per la protezione dei dati personali (Italian DPA)
4. Decreto Legislativo 196/2003 (Codice Privacy) as amended, Normattiva
5. Gazzetta Ufficiale (official publication)
6. Regulation (EU) 2024/1689 (EU AI Act)