What is a Data Protection Impact Assessment (DPIA)?

When a DPIA is required

Article 35 requires a DPIA when processing is likely to result in a high risk to people’s rights and freedoms, particularly where new technologies are used. Supervisory authorities publish lists of processing that needs one in their country.

European guidance adds nine criteria, such as data about vulnerable people or the innovative use of technology, and says processing that meets two or more will usually need a DPIA. Article 35(3) names three cases where one is always required.

• Profiling with significant effects. Systematic and extensive evaluation of people based on automated processing, including profiling, that leads to decisions with legal or similarly significant effects.
• Sensitive data at scale. Large-scale processing of special categories of data, such as health data, or of data about criminal convictions and offences.
• Public monitoring. Systematic monitoring of a publicly accessible area on a large scale.

What a DPIA contains

Article 35(7) sets the minimum content: a systematic description of the processing and its purposes, an assessment of whether the processing is necessary and proportionate to those purposes, an assessment of the risks to individuals, and the measures planned to address them, including safeguards and security measures.

The risks assessed are risks to the people whose data is processed. A DPIA asks what happens to an individual if their data is lost, misused or used to make a decision about them, how likely that is and how severe it would be.

If the assessment shows a high risk that the planned measures cannot reduce, Article 36 requires the controller to consult the supervisory authority before starting.

Keeping it useful after sign-off

A DPIA describes processing at one point in time. Article 35(11) asks the controller to review whether processing still matches the assessment, at least when the risk changes, such as when a new data source, vendor or use is added. Keep the DPIA with the record of processing for that activity so the link is clear to a regulator.

DPIAs now often sit alongside AI assessments. The EU AI Act requires certain deployers of high-risk AI systems to carry out a fundamental rights impact assessment, and where a DPIA already covers some of the same ground, the new assessment complements it.

Related terms

Data Processing Agreement (DPA)

The GDPR-required contract between a controller and a processor setting out how personal data is handled, secured, and returned or deleted.

AI impact assessment

An assessment, for each AI system, of who is affected, what could go wrong, how likely and how severe it is, and what is done about it. ISO 42001 requires one, and the EU AI Act requires its own forms for high-risk systems.

Risk register

The list of identified risks with an owner, likelihood, impact, treatment and review date, linked to the controls that treat each one. Usually the first document an auditor asks to see.

Sub-processor

A third party that processes personal data on behalf of a processor. Under GDPR a processor needs the controller’s authorisation to use one and must tell it about changes.