A DPIA (Data Protection Impact Assessment) is a structured analysis of the privacy risks of a processing activity and how they will be mitigated, carried out before deployment. Under GDPR Article 35 it is mandatory where processing is likely to result in a high risk to people's rights — and the regulation explicitly names systematic monitoring of a publicly accessible area on a large scale, which describes a great deal of video surveillance. It is the document that forces "should we, and how safely?" to be answered before cameras go live.
A DPIA for surveillance works through the system methodically: what is recorded and why, the lawful basis, what data (including any biometrics) is processed, who can access it, how long it is kept, the risks to the people captured, and the measures that reduce those risks (minimisation, privacy zones, retention limits, access control, encryption). Where residual risk stays high despite mitigation, Article 36 requires prior consultation with the supervisory authority. The EDPB Guidelines 3/2019 frame how this applies to video specifically.
The pitfall is skipping or back-dating the DPIA. Done after the system is built, it becomes a box-ticking exercise that cannot change the design; its whole value is that it is done early enough to shape camera placement, retention, and whether a high-risk feature like face recognition is justified at all. Treat the DPIA as a design input, not a compliance afterthought, and revisit it when the system materially changes. This is engineering guidance, not legal advice — confirm specifics with qualified counsel.
The handbook · 7 volumes
Fora Soft Video Engineering Handbook
A DPIA is mandatory before public-space or biometric surveillance goes live, and it is far easier when the system was designed with it in mind. Our seven-volume handbook covers the whole video stack, and for DPIA work start with Volume 7: the EU AI Act, biometric regulation and compliance for production AI. Volume 6 explains the analytics a DPIA must assess. Written by Nikolay Sapunov, CEO at Fora Soft.
Preparing a DPIA for a surveillance or face recognition rollout?
Describe the system and sites, and we will give you the technical inputs a DPIA needs: data flows, retention, access controls and risk mitigations. 250+ video products shipped since 2005.
