---
title: "Screen every new feature for a DPIA · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/records-and-data-map/dpia-screening
updated: 2026-10-20
licence: "All rights reserved"
---

# Screen every new feature for a DPIA

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map)
- Rule: Before a feature that touches personal data starts, answer a fixed screening list. When the result says high risk, finish a data protection impact assessment first.
- How: GDPR Article 35(3) always requires one for three cases. They are automated decisions with legal or similar effect, large-scale special categories, and large-scale monitoring of public places. The EDPB guidelines (WP248) add nine criteria, and two or more usually mean a DPIA. Your supervisory authority also publishes a national list. Keep the questions as data in the feature spec. If the risk stays high after your measures, Article 36 requires you to consult the authority before you start.
- Check: Every pull request that adds a processing activity or a flagged column carries a screening file. The build fails when it scores two or more criteria, or marks an automated decision with legal effect, and no DPIA link is filled in.

Example:

```yaml
feature: delivery-time-predictions
criteria:
  evaluation_or_scoring: true
  automated_decision_with_legal_effect: false
  systematic_monitoring: false
  special_or_highly_personal_data: false
  large_scale: true
  matching_or_combining_datasets: true
  vulnerable_people: false
  new_technology: true
  blocks_a_right_or_service: false
dpia: docs/dpia/delivery-time-predictions.md
```

```js
const isDpiaRequired = ({ criteria }) =>
  criteria.automated_decision_with_legal_effect || Object.values(criteria).filter(Boolean).length >= 2;
if (isDpiaRequired(screening) && !screening.dpia) throw new Error(`${screening.feature}: DPIA required before launch`);
```

```python
def is_dpia_required(screening: dict) -> bool:
    criteria = screening["criteria"]
    return bool(criteria["automated_decision_with_legal_effect"]) or sum(map(bool, criteria.values())) >= 2

if is_dpia_required(screening) and not screening.get("dpia"):
    raise SystemExit(f"{screening['feature']}: DPIA required before launch")
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/records-and-data-map/dpia-screening`.

- Previous: [Mark special categories and children's data](https://agentwranglers.se/playbook/compliance/records-and-data-map/special-category-flags)
- Next: [Keep one retention schedule](https://agentwranglers.se/playbook/compliance/records-and-data-map/retention-schedule)
- [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map)