The CNIL‘s screening rule sounds simple: hit two of the nine high-risk criteria, and you owe a full Data Protection Impact Assessment (DPIA). The trouble starts when you hit one or none, because the GDPR never says that skipping the DPIA means skipping assessment altogether.
Plenty of processing falls outside the CNIL’s screening rules: operations below the two-criteria threshold, activities on the CNIL’s exemption list, processing already covered by an earlier DPIA, and controllers who answer to a different supervisory authority altogether. In every one of those cases, the Article 35 GDPR DPIA obligation may fall away while the risk assessment obligations under Articles 24 and 32 stay exactly where they were. This article maps the scenarios where CNIL criteria don’t apply and what a defensible assessment strategy looks like when they don’t.
DPIA vs General Risk Assessment: Core Distinctions Under GDPR
These two assessments get conflated constantly, and the mix-up has real consequences. They rest on different legal bases, serve different purposes, and trigger under different conditions.
Article 35 GDPR requires a DPIA where processing is “likely to result in a high risk” to people’s rights and freedoms, and it requires the assessment before processing begins. The DPIA looks outward. It evaluates the necessity and proportionality of the processing and the risks it creates for data subjects: discrimination, identity theft, financial loss, reputational damage, loss of control over personal data. The measuring stick throughout is harm to people.
Article 32 GDPR requires controllers and processors to put in place technical and organizational measures (TOMs) appropriate to the risk of the processing. You can’t know what’s appropriate without assessing that risk first, so Article 32 carries an implicit risk assessment duty for every processing operation you run, high risk or not. Its focus is security: the confidentiality, integrity, availability, and resilience of the systems handling personal data.
Article 24 completes the picture by making the controller responsible for implementing measures proportionate to risk and able to demonstrate compliance. That’s the accountability principle at work.
So risk assessment is universal, and the DPIA is the escalated version you reserve for processing that crosses the high-risk line. The real question is which assessment to run and how deep to go.
You don't need a six-figure budget to be GDPR compliant. You need a clear plan and someone to do the work.
Affordable GDPR Compliance Services
The CNIL Criteria: A Quick Recap
The Article 35(3) Baseline and the 9 Criteria
Article 35(3) names three situations where a DPIA is always mandatory: systematic and extensive automated evaluation of individuals, including profiling, with legal or similarly significant effects; large-scale processing of special categories of data (Article 9) or criminal conviction data (Article 10); and large-scale systematic monitoring of a publicly accessible area.
Beyond those, the WP29 guidelines on DPIAs (WP248 rev.01), endorsed by the European Data Protection Board (EDPB), list nine criteria that indicate likely high-risk processing: evaluation or scoring, including profiling; automated decision-making with legal or similarly significant effect; systematic monitoring; sensitive data or data of a highly personal nature; processing on a large scale; matching or combining datasets; data concerning vulnerable data subjects (employees, patients, children); innovative use or application of new technological or organizational solutions; and processing that prevents data subjects from exercising a right or using a service or contract.
The “Two Criteria” Threshold Rule
The CNIL’s position is that processing meeting at least two of the nine criteria requires a DPIA as a general rule. WP248 leaves room on both sides of that line: a controller can conclude that processing meeting two criteria still isn’t high risk, and in some cases a single criterion is enough to trigger the obligation. Either way, the reasoning has to be documented. Where there’s genuine doubt, the CNIL’s advice is simple: do the DPIA.
CNIL’s List of Processing Operations Requiring a DPIA
The CNIL also maintains a mandatory list under Article 35(4), adopted through Deliberation No. 2018-327 of October 11, 2018. It names 14 types of processing that require a DPIA outright, including systematic employee monitoring, whistleblowing schemes, profiling that can exclude people from a contract, and large-scale processing of health data. If your processing appears on this list, you can skip the criteria math because the DPIA is mandatory regardless.
Insider Note: The CNIL’s sectoral “referentials” do more work than most DPOs realize. If your processing fully complies with an applicable referential, the CNIL accepts the position that residual risk isn’t high, which takes Article 36 prior consultation off the table. Checking for a referential before scoping a DPIA can remove the most painful step of the entire process.
When CNIL Criteria Don’t Apply: Key Scenarios
Processing Falling Below the Two-Criteria Threshold
Most B2B processing lives here. A standard CRM, a newsletter list, routine supplier management: these might touch one criterion (large scale, perhaps) without hitting a second. No DPIA is required, but the screening itself is a compliance artifact. Record which criteria you tested, what you concluded, and why. If the CNIL inspects, the absence of a DPIA is defensible only when the screening decision is on paper.
Operations on CNIL’s Exemption List
Article 35(5) lets supervisory authorities publish “whitelists” of processing that doesn’t require a DPIA. The CNIL adopted one in 2019 after an EDPB opinion, covering categories such as routine HR management in organizations with fewer than 250 employees (without profiling, biometrics, or sensitive data), badge-based physical access control without biometrics, and time management systems that don’t process biometric data. France is one of only a few member states with a formal whitelist, which matters for cross-border groups: the same HR system can be exempt in France and assessable case by case in Luxembourg.
Processing Authorized by Specific Legal Provisions
Article 35(10) carves out processing based on a legal obligation or public interest task under Article 6(1)(c) or (e), where the legal basis regulates the specific operation and a general impact assessment was already carried out when that law was adopted. It’s a narrow exemption. It doesn’t cover processing that merely relates to a legal obligation; the law itself has to govern the operation in question.
Pre-Existing DPIAs Covering Similar Processing
Article 35(1) allows a single assessment to cover a set of similar processing operations presenting similar high risks. The CNIL confirms that where the nature, scope, context, and purposes of a new operation closely match processing already assessed, whether by you or by a third party such as a public authority or a group of controllers, the earlier DPIA’s results can be reused. Document the similarity analysis rather than just asserting it.
Processing Governed by Other Supervisory Authorities
CNIL lists bind processing under the CNIL’s jurisdiction. A controller whose main establishment sits in Ireland or Germany deals with its own lead supervisory authority under the one-stop-shop mechanism, and each authority publishes its own Article 35(4) list. The nine WP248 criteria still apply everywhere, since the EDPB treats them as the consistency backbone behind every national list, but the national additions and exemptions differ. The ICO’s DPIA guidance, for instance, adds UK-specific triggers such as innovative technology combined with any WP248 criterion.
What to Do When a DPIA Isn’t Triggered: The Risk Assessment Path
Even without a DPIA, three obligations remain.
- First, conduct the Article 32 risk assessment. Map the data flows, identify realistic threats (unauthorized access, loss, alteration, unavailability), rate likelihood and severity, and select TOMs proportionate to what you find: encryption, pseudonymization, access controls, backup and recovery, and regular testing of those measures. Established methodologies work fine here; ISO/IEC 29134 provides privacy impact assessment guidance, and the NIST Privacy Framework offers a structure many teams pair with their existing security program.
- Second, document why no DPIA was performed. Organizations skip this step more than any other, and it tends to be the first thing an inspector asks for. A one-page screening record referencing the criteria, the exemption relied on, and the date of the decision is usually enough.
- Third, keep the accountability machinery running. The processing goes in your Records of Processing Activities (ROPA), privacy by design and by default under Article 25 still applies, and data subject rights are untouched by any DPIA exemption.
Pro Tip: Build DPIA Screening into your ROPA Workflow
Build DPIA screening into your ROPA workflow instead of treating it as a separate exercise. Add three fields to each ROPA entry: criteria met, DPIA yes/no, and rationale. You get a permanent, dated audit trail with almost no extra effort, and periodic reassessment becomes a filter query instead of a project.
Comparing the Two Approaches Side-by-Side
Methodology differs too. DPIAs typically follow the CNIL’s PIA methodology or ISO/IEC 29134 and demand structured stakeholder involvement: the DPO’s advice must be sought, processors have to assist under Article 28, and data subjects’ views should be gathered where appropriate. Article 32 assessments plug into whatever risk framework your security team already uses (ISO 27005, NIST, EBIOS) and can stay internal.
Practical Decision Framework: DPIA or Risk Assessment?
Step 1: Screen against the lists first. Check Article 35(3), then the applicable supervisory authority’s mandatory list. A hit at this stage ends the analysis; the DPIA is required.
Step 2: Check the exemption routes. The whitelist, the Article 35(10) legal-provision exemption, and reusable prior DPIAs. If one applies, record which one and why.
Step 3: Count the criteria. Score the processing against the nine WP248 criteria. Two or more points to a DPIA. Meeting just one deserves a documented judgment call, keeping WP248’s caveat in mind that a single criterion can be enough for genuinely risky processing.
Step 4: Choose the assessment and calendar the review. DPIA if triggered, Article 32 assessment if not. In both cases, set a reassessment trigger: material change to the processing, new data categories, new technology, or three years, whichever comes first.
Common Pitfalls When CNIL Criteria Don’t Apply
Assuming No Assessment Is Needed at All
The most common failure. Articles 24 and 32 apply to a two-person newsletter list the same way they apply to a biometric access system, differing only in depth. Concluding that you don’t need a DPIA settles the scoping question and nothing else.
Confusing DPIA Exemption with Compliance Exemption
The CNIL states this explicitly in its whitelist materials, and the EDPB repeats it in every whitelist opinion: exempt processing must still satisfy the Article 5 principles, lawful basis requirements, and data subject rights. If you’re weighing the broader difference between a formal standard and a legal obligation, our breakdown of DPIA exemption versus compliance exemption is worth a read.
Important: An Article 35(5) whitelist entry exempts you from one document. It doesn’t touch lawfulness, minimization, transparency, security, or breach notification. Treating the whitelist as a safe harbor is how routine HR processing ends up in an enforcement decision.
Overlooking Sector-Specific Guidance
EDPB guidelines, CNIL referentials, and codes of conduct under Article 40 can all shift the analysis. Article 35(8) requires compliance with an approved code of conduct to be taken into account when assessing impact. Ignoring the sectoral layer produces screening decisions that look fine on paper but fall apart once the sector context comes in.
You don't need a six-figure budget to be GDPR compliant. You need a clear plan and someone to do the work.
Affordable GDPR Compliance Services
Cross-Jurisdictional Considerations
Controllers established outside France aren’t bound by CNIL lists for processing under another authority’s jurisdiction. What travels is WP248: the EDPB required every national list to state that it complements and further specifies those guidelines, so the nine criteria function as the common denominator across the EU.
EDPB Guidelines 4/2019 on data protection by design and by default add the other half of the frame. Whatever assessment you run, Article 25 requires safeguards to be designed in from the start, not bolted on after the risk analysis.
For multi-jurisdictional processing, two practical rules hold. Identify your lead supervisory authority under the one-stop-shop mechanism, and where a single processing operation spans several member states’ lists, apply the most demanding trigger among them. A DPIA that meets the strictest list will hold up everywhere else, and that logic doesn’t work in reverse.
Worth Knowing: EDPB published a Draft EU-wide DPIA
In April 2026, the EDPB published a draft EU-wide DPIA template and opened a public consultation running to June 2026. It doesn't change when a DPIA is required, but it signals convergence on how DPIAs get documented, and national authorities may adopt it as a standard. It's worth tracking if you maintain DPIA templates across several jurisdictions.
Conclusion: Building a Defensible Assessment Strategy
The CNIL criteria answer one question: does this processing need a DPIA? When they don’t apply, the question changes shape instead of going away. Article 32 still demands a security risk assessment, Article 24 still demands proof of proportionate measures, and the screening decision itself becomes the document that protects you. A defensible strategy is boring by design: screen every new processing operation, record the outcome either way, run the assessment the outcome calls for, and revisit on change or every three years. Controllers get in trouble far more often for having no paper trail than for choosing the lighter assessment.
Frequently Asked Questions
Is a risk assessment mandatory even if no DPIA is required?
Yes. Article 32 obliges every controller and processor to assess risk and implement appropriate technical and organizational measures for all processing of personal data. A DPIA exemption takes one document off your list. The underlying duty stays.
Can I use CNIL's PIA software for a standard risk assessment?
You can. The CNIL’s free PIA tool is built around the DPIA methodology, so it’s heavier than an Article 32 assessment needs, but its risk mapping module works well for structuring a security-focused analysis. Many teams use it for both and skip the necessity and proportionality sections for non-DPIA processing.
What happens if I incorrectly conclude that CNIL criteria don't apply?
Failing to carry out a required DPIA is sanctionable on its own, with fines of up to 10 million euros or 2% of global annual turnover under Article 83(4). Supervisory authorities have also treated missing DPIAs as aggravating factors in broader enforcement. A documented, good-faith screening decision materially improves your position even when a regulator disagrees with the conclusion.
How long does an ISO 14001 audit take?
Duration depends on the size of the organization, the complexity of its processes, the number of sites, and the industry risk profile — with audit time calculated under ISO/IEC 17021-1 guidance. A small organization might face a Stage 2 audit of one to two days and shorter surveillance visits, while a large multi-site operation requires considerably more.
What is the difference between an internal and external ISO 14001 audit?
An internal audit is conducted by or for the organization itself to check and improve its own EMS. An external audit is conducted by an outside party — either a certification body awarding or maintaining the certificate, or a second party such as a customer assessing a supplier.
Can I use a free ISO 14001 audit checklist template?
Yes, a free template is a reasonable starting point, but treat it as a skeleton. Any generic template must be adapted to your significant environmental aspects, your compliance obligations, and your operations — and as of 2026 it must be updated for the new and revised clauses. An unedited template will leave gaps that produce findings.
What happens if nonconformities are found during the audit?
You analyze the cause, define corrections and corrective actions, and implement them. Certification bodies typically require this within a set window after the audit and then verify it. Major nonconformities must be closed before a certificate is granted or maintained. Minor nonconformities are usually verified at the next surveillance visit.
