Skip to content
ContactRequest a demo

Glossary · D · DPIA

Data protection impact assessment

An empty meeting room against the light

Definition

A data protection impact assessment (DPIA) is the risk analysis required by Art. 35 GDPR for processing that is likely to result in a high risk to people's rights and freedoms.

Some processing operations reach deeper into people's rights than others. For those, the GDPR requires the risks to be assessed and documented systematically before processing starts. That procedure is the data protection impact assessment.

#When it is required

Art. 35 GDPR gives typical cases, and supervisory authorities also publish lists of processing that always requires a DPIA. Common triggers in customer service:

  • Systematic analysis of many conversations, for example by topic or sentiment.
  • Automated decisions or profiling with noticeable effects on customers.
  • Special categories of data, such as health data at health insurers.
  • New technologies such as AI agents that act in business systems.

The controller decides whether a DPIA is needed, advised by the data protection officer. When in doubt, it is the safe choice.

#What goes into it

  1. Description: which data, which purposes, which systems and recipients?
  2. Necessity: is the processing necessary and proportionate for the purpose?
  3. Risks: what could go wrong for the people concerned, how likely, how severe?
  4. Measures: how are the risks limited, technically and organisationally?

If a high risk remains despite the measures, the supervisory authority must be consulted before processing begins (Art. 36 GDPR).

#Not a one-off document

A DPIA is never quite finished. When purposes, data types or technology change, for instance because a new AI feature is added, it has to be reviewed (Art. 35(11) GDPR). So schedule regular reviews.

#Which documents help

The controller writes the DPIA, not the provider. But it needs material: a description of the platform and its data flows, the technical and organisational measures, the list of sub-processors, deletion and role concepts.

Team meeting in a glass meeting room in the evening
A DPIA is built in conversation: business, IT, data protection and, where needed, the works council.

#Support from Univerx

Documents for your DPIA are available from Univerx on request, together with the data processing agreement. For AI features, information on disclosure, human oversight and logging is added, see EU AI Act. Overview in the Trust Center: GDPR.

Share

All terms
View all
  • Berlin at blue hour with the TV tower
    Guides2 November 2026 · 11 min read

    Running a contact centre in Europe

    What the GDPR, the EU AI Act and German co-determination mean for routing, recording and analytics – and how to answer the questions from procurement, privacy and the works council before the first contact runs on a new platform.

  • Hands typing on a keyboard in the dark
    Guides2 November 2026 · 11 min read

    Introducing AI agents responsibly

    Disclosure, handover, permissions, logging, approval and measurement: what should be settled before an AI agent goes live in customer service – step by step, with a checklist for the project team.

  • Two colleagues talking in a dimly lit office
    Public sector30 October 2026 · 5 min read

    Social data protection in the contact centre: roles, recording, analytics

    Social data needs more than a tick in the privacy notice. It needs roles that fit, recording with a reason, and analytics that show topics rather than people.

  • Team meeting in a glass meeting room in the evening
    Practice & how-to2 November 2026 · 5 min read

    Talking to the works council about analytics: a preparation

    If you plan to introduce analytics, know the works council's questions before they are asked. A preparation in documents, roles and configuration.

  • Forms and a pen on a dark desk
    Trust & Europe

    GDPR

    Processing under Art. 28 GDPR, documents for your data protection impact assessment, retention and deletion policies and role rights. What exists you receive on request; what is a goal we call a goal.

  • Wood-panelled council chamber with chandeliers
    Trust & Europe

    EU AI Act

    AI disclosure in dialogue, human oversight, logging and model approval: Univerx is designed for the duties of the AI Act. Which risk class your use case falls into, we work out together.

  • Forms and a pen on a dark desk
    Products

    Privacy

    Your data stays your data: region choice within the EU, a sub-processor list, deletion and export, role-based rights and a data processing agreement under Art. 28 GDPR on request.

  • Employee wearing a headset at a screen
    Products

    Responsible AI

    Transparency, human oversight, fairness, privacy and governance for every AI module in Univerx: AI agents, Univerx Assist, conversation analytics, knowledge and Semantic². Principles that work as settings.

  • A person in front of a wall of monitoring screens
    Products

    Conversation Analytics

    Transcripts, topics, sentiment, compliance cues and root causes from calls and messages. So you see why customers get in touch, not just how often. Configurable for co-determination.

See Univerx on your own example.

In a demo we show the platform along your channels and requests, from AI agents to video, workforce scheduling and analytics.

Request a demoGet in touch

Online, in German or English, with no preparation on your side.