EU Member State DPIA Whitelists, Blacklists and Guidance

Data protection authorities of many EU member states have published draft lists of data processing activities that would trigger the need for a data protection impact assessment in that country.

The European Data Protection Board weighed in on the drafts, you can find its opinions here. And IAPP Westin Fellow Müge Fazlioglu, CIPP/E, CIPP/US, has written an analysis of the opinions here.

Country DPIA blacklist/whitelist

Austria Whitelist from the Austrian Data Protection Authority

Belgium Blacklist & whitelist from the Belgian Privacy Commission

Bulgaria (Not yet available)

Croatia (Not yet available)

Cyprus (Not yet available)

Czech Republic (Not yet available)

Denmark (Not yet available)

Estonia (Not yet available)

Finland (Not yet available)

France Blacklist from the CNIL

Germany Blacklists from German DPAs

Germany: Baden-Wuerttemberg Blacklist from The State Commissioner for Data Protection Baden-Württemberg

Germany: Brandenburg Blacklist from The Data Protection Supervisor and the Right to File Inspection

Germany: Federal Commissioner Blacklist

Germany: Hamburg Blacklist

Germany: Hessen Blacklist from The State Commissioner for Data Protection Hessen

Germany: Lower Saxony Blacklist from The State Commissioner for Data Protection Niedersachsen

Germany: North Rhine-Westphalia Blacklist

Germany: Rhineland-Palatinate Private Bodies Blacklist, Public Bodies Blacklist

Germany: Saarland Blacklist

Germany: Saxony Blacklist from The State Commissioner for Data Protection Sachsen

Germany: Schleswig-Holstein Blacklist from The State Commissioner for Data Protection Schleswig-Holstein

Germany: Thuringia Blacklist from The State Commissioner for Data Protection Thüringer

Greece (Not yet available)

Hungary Blacklist from the Hungarian data protection authority

Ireland Blacklist from the Data Protection Commission

Italy Blacklist from the Italian Data Protection Authority

Latvia (Not yet available)

Lithuania (Not yet available)

Luxembourg (Not yet available)

Malta (Not yet available)

The Netherlands (Not yet available)

Poland Blacklist from Poland's DPA

Portugal Blacklist from Portugal's National Commission for Data Protection

Romania Blacklist from the Romanian DPA (In Romanian; In English, translated by PrivacyOne)

Slovakia Draft list of the competent supervisory authority of Slovakia

Slovenia (Not yet available)

Spain (Not yet available)

Sweden (Not yet available)

United Kingdom Blacklist from the Information Commissioner's Office