This checklist determines whether a Data Protection Impact Assessment (DPIA) is required under Article 35 of the GDPR before launching a new project, product, feature, or service that involves the processing of personal data.
Under Article 35(1) GDPR, a DPIA is mandatory when processing is "likely to result in a high risk to the rights and freedoms of natural persons." The EDPB Working Party 29 Guidelines (WP 248 rev.01) identify nine criteria to assess this risk. As a general rule, if two or more criteria are met, a DPIA is required.
This checklist must be completed before any of the following:
The completed checklist must be retained as evidence of compliance, regardless of whether a full DPIA is subsequently required.
| Project / Service Name | |
| Project Owner | |
| Date of Screening | |
| Brief Description of Processing | |
| Categories of Data Subjects | |
| Categories of Personal Data | |
| Legal Basis (Art. 6 GDPR) |
For each criterion below, check the box if it applies to the planned processing. Answer honestly -- underestimating risk exposes the company to regulatory sanctions.
Does the processing involve evaluating or scoring individuals, including profiling and predicting?
Does the processing involve automated decision-making that produces legal effects or similarly significant effects on individuals?
Does the processing involve systematic monitoring of individuals, including observation of publicly accessible areas?
Does the processing involve special categories of data (Art. 9 GDPR), criminal conviction data (Art. 10), or other highly personal data (location, financial, communications)?
Is the processing carried out on a large scale, considering the number of data subjects, volume of data, duration/permanence, and geographical extent?
Note: At current Easylab scale (early-stage, limited client base), most processing is unlikely to qualify as "large scale." This criterion should be re-evaluated as the business grows.
Does the processing involve matching or combining datasets from different sources in a way that exceeds the reasonable expectations of the data subject?
Does the processing concern vulnerable individuals who may be unable to easily consent to or oppose the processing?
Does the processing involve the use of new or innovative technologies, including AI, machine learning, or other emerging technologies?
Note: As of 2026, generative AI is still considered "innovative technology" by most DPAs. This criterion applies to virtually all Easylab AI-powered services.
Does the processing prevent individuals from exercising a right, or using a service or a contract?
Note: This criterion is less likely to apply to current Easylab services, which are primarily B2B tools. However, it should be assessed if any service gates access based on personal data processing.
| Total criteria checked | _____ / 9 |
A full DPIA is not legally required. However, conducting a DPIA is recommended if criterion 8 (innovative technology) is met, even alone. The EDPB emphasizes that the use of AI on personal data warrants careful assessment regardless of the formal threshold.
Retain this completed checklist as evidence of your assessment.
A Data Protection Impact Assessment must be completed before the processing begins (Art. 35(1) GDPR). Processing must not start until the DPIA is completed and, if necessary, mitigating measures have been implemented.
If the DPIA concludes that residual risk remains high despite mitigations, the supervisory authority (CNPD in Luxembourg) must be consulted under Article 36 GDPR before proceeding.
| Decision | DPIA Required / Not Required (circle one) |
| Assessed by | |
| Date | |
| Reviewed by |
If the screening above indicates that a DPIA is required, use the following structure. For complex or high-risk processing, consider engaging external legal counsel or a qualified DPO.
Describe: nature, scope, context, and purposes of the processing. Include data flows, technologies used, data categories, data subjects, retention periods, and sub-processors involved.
Assess: legal basis (Art. 6, Art. 9 if applicable), purpose limitation, data minimization, data quality, storage limitation, information to data subjects (Art. 13/14), right to object, data portability, lawfulness of international transfers.
Identify and rate risks by likelihood (unlikely / possible / likely) and severity (limited / significant / maximum). Consider: illegitimate access, unwanted modification, data loss, re-identification, discrimination, financial loss, reputational damage, loss of autonomy.
For each risk identified, document: the mitigating measure, its effect on likelihood/severity, the responsible person, and the implementation deadline. Include both technical measures (encryption, access controls, pseudonymization, logging) and organizational measures (policies, training, audits, incident response).
State whether residual risk is acceptable. If residual risk remains high, document the decision to consult the CNPD (Art. 36). Obtain sign-off from the project owner and, if appointed, the Data Protection Officer.
The following assessments are indicative and based on current product scope as of March 2026. They must be reviewed when product features change.
| # | Criterion | Applies? | Rationale |
|---|---|---|---|
| 1 | Evaluation or scoring | YES | Health Score calculated from blood test results |
| 2 | Automated decision-making | Possible | Health recommendations could influence medical decisions; depends on implementation |
| 3 | Systematic monitoring | No | One-time or periodic analysis, not continuous monitoring |
| 4 | Sensitive data | YES | Health data (Art. 9 GDPR special category) |
| 5 | Large scale | No | Currently limited user base |
| 6 | Matching datasets | No | Single data source (lab results) |
| 7 | Vulnerable data subjects | Possible | Patients may be considered vulnerable depending on context |
| 8 | Innovative technology | YES | Generative AI (LLM) used for health data analysis |
| 9 | Blocking a right/service | No | Not applicable |
Result: 3 criteria met (minimum) -- DPIA MANDATORY
| # | Criterion | Applies? | Rationale |
|---|---|---|---|
| 1 | Evaluation or scoring | YES | AI-based profiling and scoring of LinkedIn profiles |
| 2 | Automated decision-making | Possible | Depends on whether output is used for hiring decisions without human review |
| 3 | Systematic monitoring | Possible | Systematic collection from public profiles could qualify |
| 4 | Sensitive data | Possible | LinkedIn profiles may reveal religion, ethnicity, political opinions indirectly |
| 5 | Large scale | No | Currently limited usage |
| 6 | Matching datasets | Possible | If combined with internal HR data |
| 7 | Vulnerable data subjects | Possible | Job seekers are in a power imbalance with recruiters |
| 8 | Innovative technology | YES | Generative AI used for profile analysis |
| 9 | Blocking a right/service | Possible | If used to filter out candidates from recruitment process |
Result: 2 criteria met (minimum) -- DPIA MANDATORY
| # | Criterion | Applies? | Rationale |
|---|---|---|---|
| 1 | Evaluation or scoring | No | Transcription and summarization, not scoring individuals |
| 2 | Automated decision-making | No | Output is informational (minutes), not decision-making |
| 3 | Systematic monitoring | Possible | Audio recording of meetings could qualify depending on scope |
| 4 | Sensitive data | YES | Meeting audio may contain sensitive opinions, financial data, strategic discussions |
| 5 | Large scale | No | Currently limited client base |
| 6 | Matching datasets | No | Single data source per processing operation |
| 7 | Vulnerable data subjects | No | Board members and executives are not typically considered vulnerable |
| 8 | Innovative technology | YES | Generative AI (LLM) + speech-to-text for meeting transcription |
| 9 | Blocking a right/service | No | Not applicable |
Result: 2 criteria met (minimum) -- DPIA MANDATORY
| # | Criterion | Applies? | Rationale |
|---|---|---|---|
| 1 | Evaluation or scoring | No | Static website, no profiling |
| 2 | Automated decision-making | No | No automated decisions |
| 3 | Systematic monitoring | No | Standard analytics only (if any) |
| 4 | Sensitive data | No | Contact form data only |
| 5 | Large scale | No | Small website |
| 6 | Matching datasets | No | No dataset combination |
| 7 | Vulnerable data subjects | No | General public, B2B visitors |
| 8 | Innovative technology | No | Standard website technology |
| 9 | Blocking a right/service | No | Not applicable |
Result: 0 criteria met -- DPIA not mandatory