DPIA
A Data Protection Impact Assessment (DPIA) is the documented analysis a controller must carry out before processing that is likely to result in a high risk to people's rights, describing the processing, its necessity and the measures that address the risks.Article 35 of the GDPR requires a DPIA for processing likely to result in a high risk, in particular systematic and extensive profiling with significant effects, large-scale processing of special categories of data, and systematic monitoring of publicly accessible areas on a large scale. Each supervisory authority publishes a list of operations that always require one; the ICO's list includes tracking individuals' location or behavior online, and the CNIL's includes profiling for advertising on a large scale. The assessment must describe the processing and its purposes, assess necessity and proportionality, identify the risks to data subjects and the measures that mitigate them, and involve the DPO where one exists. If the residual risk stays high, the authority must be consulted first.
Websites rarely need a DPIA for a cookie banner itself, but one is expected for large-scale behavioral advertising, cross-site profiling, or combining tracking data with customer records. US state laws require a comparable data protection assessment for targeted advertising, sales of data and profiling, and Quebec's Law 25 requires a privacy impact assessment before transferring personal information outside Quebec. The cookie audit checklist is a practical starting point: knowing which trackers run, for whom and with what data is the inventory a DPIA builds on.