Screen every new feature for a DPIA

How to do it

GDPR Article 35(3) always requires one for three cases. They are automated decisions with legal or similar effect, large-scale special categories, and large-scale monitoring of public places. The EDPB guidelines (WP248) add nine criteria, and two or more usually mean a DPIA. Your supervisory authority also publishes a national list. Keep the questions as data in the feature spec. If the risk stays high after your measures, Article 36 requires you to consult the authority before you start.

Example

feature: delivery-time-predictions
criteria:
  evaluation_or_scoring: true
  automated_decision_with_legal_effect: false
  systematic_monitoring: false
  special_or_highly_personal_data: false
  large_scale: true
  matching_or_combining_datasets: true
  vulnerable_people: false
  new_technology: true
  blocks_a_right_or_service: false
dpia: docs/dpia/delivery-time-predictions.md

const isDpiaRequired = ({ criteria }) =>
  criteria.automated_decision_with_legal_effect || Object.values(criteria).filter(Boolean).length >= 2;
if (isDpiaRequired(screening) && !screening.dpia) throw new Error(`${screening.feature}: DPIA required before launch`);

def is_dpia_required(screening: dict) -> bool:
    criteria = screening["criteria"]
    return bool(criteria["automated_decision_with_legal_effect"]) or sum(map(bool, criteria.values())) >= 2

if is_dpia_required(screening) and not screening.get("dpia"):
    raise SystemExit(f"{screening['feature']}: DPIA required before launch")

How to check

Every pull request that adds a processing activity or a flagged column carries a screening file. The build fails when it scores two or more criteria, or marks an automated decision with legal effect, and no DPIA link is filled in.