What is a DPIA and when is one required?
A Data Protection Impact Assessment is the GDPR's mechanism for examining high-risk processing before it happens. Article 35 requires one where processing is likely to result in a high risk to individuals, and names large-scale processing of special category data as a case where the requirement applies. Supervisory authorities have published criteria for recognising high risk, including the processing of sensitive data, data concerning vulnerable individuals, systematic monitoring, processing at scale, and the matching of datasets, with guidance treating the presence of more than one criterion as the signal that an assessment is due.
Does a travel risk programme trigger it?
Walk a typical programme through those criteria. Employees are treated in regulators' guidance as vulnerable data subjects, because the imbalance of power makes free consent doubtful. Traveller tracking and location monitoring are systematic monitoring on their face. Individualised assessment that touches health, disability, orientation, or belief is special category processing. A multinational programme runs at scale by definition. Most configurations meet several criteria at once, and the defensible answer to the title question, for most organisations, is yes. A programme that has never been assessed is not evidence the requirement does not apply; it is usually evidence of the finding the assessment would make.
What does the DPIA usually find?
Three recurring findings. First, vendor opacity: the fields a travel risk vendor actually holds about travellers have often never been classified against Article 9, and assistance codes transmitted through booking systems broadcast disability categories across an ecosystem the traveller cannot audit. Second, the informal layer: managers under duty-of-care pressure keep records the official systems will not hold, the pattern documented as Shadow HR, and a DPIA scoped only to sanctioned systems misses where the risk actually lives. Third, the lawful-basis strain: programmes resting on employee consent are resting on a basis regulators treat with scepticism and any employee can withdraw.
Can the mitigation be "collect less"?
Yes, and in this domain it is often the only mitigation that closes the risk rather than documenting it. Data minimisation is not a constraint on accountability; the position that minimising collection is itself an accountability mechanism has institutional articulation in the AI policy research community. A DPIA whose outcome is an architectural change, individualised assessment delivered without central retention of the attributes, resolves the high risk at its source. An assessment that ends in a risk register entry has described the exposure; an assessment that ends in less data has removed it.
Who answers for the vendor's data?
Outsourcing the assessment does not outsource the accountability. The organisation that directs the processing remains the controller of what it directs, whichever vendor performs it, and the questions a DPIA puts to a vendor are therefore the organisation's own questions: which fields, which lawful basis, which retention period, which subprocessors, and what happens to the record when the contract ends. If the vendor cannot answer field by field, that is itself a finding.
The question to bring to your DPO
When was the last DPIA conducted on the travel risk programme as it actually operates, including the informal layers, rather than as it is documented? If the answer is never, the first finding is already in hand.