DPIA questions for identity and age systems
A DPIA should describe the real identity or age-assurance data flow, not a generic vendor diagram. It must test necessity, proportionality, roles, risks, safeguards and alternatives before high-risk processing begins.
GDPR Article 35 governs DPIAs. The EUDI Regulation expressly preserves GDPR responsibilities, and age-assurance guidance emphasises necessity, proportionality, effectiveness and data minimisation.
For: DPOs, privacy counsel, product owners, security and risk teams. This is independent information, not legal, compliance or security advice.
Purpose and necessity
- What exact service decision requires identity or age evidence?
- Which rule, risk or contract drives it?
- Can fewer attributes or a less intrusive method achieve the purpose?
- Is the method effective enough to justify its impact?
Data-flow inventory
- Raw document images and extracted attributes.
- NFC/chip data and digital signatures.
- Selfie/video, face template or age-estimation output.
- Device, session and fraud signals.
- Wallet requests, presentations and logs.
- Manual-review records, decisions and appeals.
Roles and lifecycle
- Controller, joint controller and processor per operation.
- Recipients, subprocessors and transfer locations.
- Collection, access, retention, deletion and backup behaviour.
- Model improvement or secondary use.
- Incident, correction and data-subject request responsibility.
People and failure
- False acceptance, false rejection and discriminatory impact.
- Children and vulnerable people.
- People without documents, devices, stable connectivity or conventional appearance.
- Coercion, identity theft and account recovery.
- Transparent explanation, human review and redress.
Decision record
Record rejected alternatives, residual risks, approving roles, consultation and conditions for reassessment. Revisit the DPIA after a new method, model, provider, purpose, geography, material incident or regulatory change.
Additional questions for recruitment and employment
- What makes the identity check necessary for this role, and could a less intrusive process achieve the purpose?
- What happens to an applicant who cannot complete the default route?
- What Article 6 basis applies, and does the processing also require a separate Article 9 condition?
- Could the applicant-employer power imbalance make consent inappropriate for the proposed processing?
- Could technical failure exclude someone from employment, and can the reviewer genuinely change the outcome?
- Does any solely automated decision have legal or similarly significant effects?
Record the DPIA screening decision and reassess it when the technology, purpose or consequences change. These questions flag issues for qualified review; they are not a finding that every employment identity check requires biometrics or a DPIA.
Evidence and limits
MyID separates enacted rules, official implementation material, testing and vendor claims. A source can establish what its publisher says; it does not prove that every product, deployment or interpretation works as claimed. Where Irish implementation remains unsettled, this page says so.
- General Data Protection Regulation
- Data Protection Commission
- EDPB Statement 1/2025 on Age Assurance
- Regulation (EU) 2024/1183
- EDPB Guidelines 05/2020 on consent
- Workplace Relations Commission: employment equality
Sources checked 5 October 2026. Re-check the linked primary material before making a consequential decision.
In this topic: Buying, privacy and implementation
How should a buyer define, procure, pilot and govern identity services?
View all 12 pages in this topic
Next useful pages
Follow the Irish evidence
Get the business briefing when Irish wallet, verification and age-assurance evidence changes.
Join the business briefing