In accordance with Art. 35 (4) GDPR, the supervisory authorities publish lists of processing activities for which a DPIA is mandatory. The "must list" published by the German data protection authorities can be downloaded as a guide.