# CNIL lists of processing operations that do or do not need a DPIA

- Type: Tools
- Source: CNIL
- Date: 2026-11-11
- Original: https://www.cnil.fr/fr/listes-des-traitements-pour-lesquels-une-aipd-est-requise-ou-non
- Canonical: https://overview.legal/posts/623981
- Topics: DPIA, Controllers, Supervision, Supervisory Authorities

## Summary

The French DPA’s two lists under Article 35(4) and (5): the types of processing for which a DPIA is always required, and those for which it is not. Every national authority publishes such a list after the EDPB’s opinion on it.

## Full text

The French DPA’s two lists under Article 35(4) and (5): the types of processing for which a DPIA is always required, and those for which it is not. Every national authority publishes such a list after the EDPB’s opinion on it.

When to use it: Your processing takes place in France, or you compare how authorities draw the DPIA line.
Provisions: GDPR Art. 35(4), GDPR Art. 35(5).
Published by CNIL (supervisory authority), for France.
For: controllers, DPOs and privacy officers.
Free; available in French.

De twee lijsten van de Franse toezichthouder onder artikel 35 lid 4 en 5: verwerkingen waarvoor altijd een DPIA nodig is, en verwerkingen waarvoor dat niet zo is. Elke nationale toezichthouder publiceert zo’n lijst na een advies van de EDPB.

Wanneer gebruiken: Je verwerking vindt plaats in Frankrijk, of je vergelijkt hoe toezichthouders de DPIA-grens trekken.

---
Generated by overview.legal · https://overview.legal/posts/623981 · 2026-11-14