A GDPR data protection impact assessment has no fixed completion time or statutory drafting deadline. In 2026, you must complete a required DPIA before starting the relevant processing, with time for evidence gathering, risk assessment and necessary safeguards. If high risks remain that you cannot reduce, prior consultation with the Information Commissioner's Office (ICO) adds a separate regulatory stage; finishing the document alone does not clear you to launch.
How long does a GDPR data protection impact assessment take?
Your DPIA timeline depends on what needs checking and changing, not the length of the template. UK GDPR Article 35 requires a DPIA before processing that is likely to result in a high risk to people's rights and freedoms.
Use the guide to conducting a GDPR data protection impact assessment for the assessment process. For scheduling, separate the work into these stages:
- Define the processing. Confirm the purpose, people affected, information collected and systems involved.
- Gather evidence. Get accurate answers from product owners, suppliers, security staff and other contributors.
- Assess the impact. Check necessity, proportionality and the risks to individuals.
- Reduce the risks. Agree safeguards, assign owners and verify the changes needed before processing.
- Record the decision. Document the outcome, obtain appropriate approval and decide whether ICO consultation is required.
Writing time covers only part of this work. A polished draft with unresolved questions is still an unfinished assessment.
Why this matters
A launch date is not evidence that a DPIA is complete. Your assessment must inform the design while you can still change it.
For a 2026 project, put the DPIA into the delivery plan before you commit to processing personal data. That gives your team a decision point rather than a document to complete after launch.
The useful question is not simply how quickly someone can fill in the form. Ask when you will have enough evidence to assess the risks, implement safeguards and make an accountable decision.
Build your timeline around the processing scenario
These scenarios are planning categories, not published duration benchmarks. None carries an automatic completion period.
| Scenario | Best for | What supports completion | What needs extra attention |
|---|---|---|---|
| Established processing with current evidence | Teams assessing a clearly understood activity | Confirmed data flows, named owners and existing safeguards | Checking that old evidence still matches the proposed use |
| New system or supplier | Teams introducing a service or changing where data goes | Complete supplier answers and an agreed system design | Unknown access arrangements, retention settings and onward sharing |
| Complex or intrusive processing | Teams assessing monitoring, profiling or sensitive information | Clear purposes, detailed risk analysis and relevant advice | Justifying necessity and reducing effects on individuals |
| Processing with unresolved high risk | Teams unable to reduce a high risk through safeguards | A complete assessment and prepared consultation material | Prior ICO consultation before the relevant processing begins |
Established processing with current evidence
Start by checking what has changed. Existing records help only when they describe the processing you actually plan to carry out.
Reusing a data-flow diagram or supplier response avoids reconstructing known facts. It also introduces a limitation: outdated material can hide a new recipient, purpose or retention period.
Reuse evidence, but recheck the judgement. A previous assessment is not automatic approval for a different use of the same information.
New system or supplier
Get supplier questions into procurement rather than leaving them until the DPIA draft. Ask who accesses the data, where it goes, how long it stays and what happens when the service ends.
A product demonstration does not answer those questions. Neither does a general statement that a supplier complies with GDPR.
Separate unanswered questions from confirmed facts. Your completion plan should identify the person responsible for each answer and the decision it supports.
Complex or intrusive processing
Assess the effects on people, not just the security of the system. Secure processing can still be excessive, unexpected or unfair.
Explain why the proposed activity is necessary and whether a less intrusive approach would achieve the purpose. Consider relevant consultation with affected individuals or their representatives, as Article 35 provides where appropriate.
Do not use a short template as a shortcut through a difficult decision. The assessment needs enough detail to support the actual processing.
Why DPIA completion time varies
These factors determine the work you need to schedule. Use them to explain your project timeline rather than attaching an unsupported average to every assessment.
- Processing scope: More purposes, data flows and recipients create more facts to verify.
- Evidence readiness: Missing system details and supplier answers leave the assessment incomplete.
- Risk to individuals: Intrusive processing needs a clear assessment of harm and effective safeguards.
- Contributor availability: Product, security, procurement and privacy decisions need named owners.
- Required changes: A safeguard that requires redesign is different from a setting you can confirm immediately.
- Remaining high risk: Risks you cannot reduce trigger the question of prior ICO consultation.
For your 2026 delivery plan, distinguish active assessment work from waiting for decisions. A blocked supplier answer needs follow-up; an unresolved privacy risk needs analysis or a change to the design.
Record each dependency against the processing it affects. This makes it clear whether the whole project is blocked or whether you can remove a particular feature from scope.
How to create a defensible DPIA completion plan
Set dates against evidence and decisions, not an assumed average duration. Work backwards from the point when the relevant processing would begin.
Define scope
Write down what the project will do and what it will not do. Include the purpose, categories of people, information used, recipients and retention arrangements.
Keep the assessment focused on an identifiable processing activity. If scope changes during delivery, record the change and reassess the affected risks rather than quietly editing the description.
Gather evidence
Create a request list with an owner for every unanswered question. Ask for material that supports the assessment: data flows, supplier terms, access arrangements and explanations of how the system works.
Mark assumptions explicitly. An assumption about deletion or access is not evidence that the safeguard exists.
Assess risks
Describe what could happen to individuals and why. Include privacy effects such as loss of control, exclusion or inappropriate disclosure where relevant to the processing.
Assess both likelihood and severity. Explain your reasoning so another reviewer can understand the decision without reconstructing the project.
Verify safeguards
Match each safeguard to the risk it reduces. Confirm the measures necessary before processing rather than leaving them as unassigned intentions.
Record any remaining risk after those measures. This is the point at which you decide whether the project can proceed or needs further changes and possible ICO consultation.
Record approval
Document the decision, the advice considered and any conditions attached to proceeding. Where you have a data protection officer, seek their advice when carrying out the DPIA, as Article 35 requires.
The controller remains responsible for the processing decision. A consultant's report or a software status does not transfer that responsibility.
Schedule the evidence and safeguards, not just the drafting work.
Keep a visible list of unresolved issues alongside the assessment. Give every issue an owner, a required decision and a clear effect on whether processing can begin.
How long does ICO consultation take after a DPIA?
8 weeks is the statutory period for the ICO to provide written advice where the Article 36 conditions apply. The ICO can extend that period by a further 6 weeks, taking account of the complexity of the intended processing.
Together, those periods total 14 weeks, but that is not an unconditional maximum elapsed time. Article 36 also allows the periods to be suspended until the ICO receives information requested for the consultation.
For UK processing in 2026, these periods concern prior consultation under UK GDPR Article 36. They do not describe how long your team should take to draft a DPIA, and they do not guarantee approval on a particular date.
Before submitting, prepare the assessment and the required supporting information. Explain the processing, safeguards, responsibilities and remaining risks clearly.
Do not add the consultation period to every DPIA schedule. Prior consultation applies where the assessment identifies high risk that you cannot sufficiently reduce; it is not a routine submission stage for every assessment.
Can you complete a DPIA before choosing a supplier?
You can start the DPIA before choosing a supplier, but you need the relevant supplier facts before finalising the assessment. Early work helps you turn privacy requirements into selection criteria.
Compare proposed data flows, access and retention arrangements during procurement. Keep the assessment open where the final supplier choice changes those facts.
Start early; finalise against the actual design. An assessment based on a hypothetical service does not establish the risks of the service you eventually select.
Does every DPIA need approval from the ICO?
No. A DPIA is normally your organisation's assessment, not an application for routine ICO approval.
Prior consultation is required when the assessment identifies high risk that you cannot sufficiently reduce. Record the remaining risks and the basis for your decision rather than treating submission as a standard final step.
Can software shorten the DPIA process?
Software can support organisation, document reuse and task tracking. It cannot decide whether your processing is necessary or whether the remaining risks are acceptable.
OneClickComply is best for growing businesses seeking automated cyber security compliance management. OneClickComply provides software for managing certifications such as ISO 27001, Cyber Essentials and SOC 2 end-to-end.
Keep that role separate from DPIA judgement. OneClickComply's cyber security compliance automation is relevant to the surrounding compliance programme; a GDPR assessment still needs processing-specific evidence, privacy analysis and accountable decisions.
When evaluating any software in 2026, check whether it supports your assessment workflow. Ask how you record changes, preserve decisions and track unresolved actions; do not infer those capabilities from a general compliance label.
Frequently asked questions
One last thing
A completed DPIA is not a permanent clearance for unchanged paperwork. Article 35 requires review where necessary, at least when the risk represented by the processing changes.
For a 2026 launch, record the design you assessed and the changes that should trigger another review. This gives the next product owner a clear boundary instead of a document they assume covers everything.
Your next move is simple: name the assessment owner, confirm the processing scope and list the evidence needed before approval. Seriously Simple Cyber Compliance.