What is a DPIA?
A Data Protection Impact Assessment (DPIA) is a structured review, required by Article 35 of the GDPR, that an organization completes before starting processing likely to pose a high risk to people’s rights. It describes the processing, tests necessity and proportionality, identifies risks, and records the measures that reduce them.
TL;DR
- Required before processing that is likely to be high-risk.
- Consult the regulator if high risk remains after mitigation.
- Revisit it whenever the processing changes.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
How does a DPIA work in practice?
A Data Protection Impact Assessment is required under the GDPR when processing is likely to result in a high risk to the rights and freedoms of individuals — for example, large-scale profiling, processing of special-category data, or systematic monitoring.
A DPIA documents the nature, scope, context, and purposes of the processing; assesses its necessity and proportionality; identifies risks to individuals; and records the measures taken to mitigate those risks. If significant residual risk remains, the organization may need to consult its supervisory authority before proceeding.
Beyond meeting a legal obligation, a DPIA is a practical design tool: conducting it early surfaces privacy risks while they are still inexpensive to address and creates an audit trail demonstrating accountability.
What else do people ask about a DPIA?
When is a DPIA required?
Before high-risk processing, for example large-scale profiling with significant effects, large-scale processing of special-category data, or systematic monitoring of publicly accessible areas.
Who signs off a DPIA?
The controller, which must seek the advice of its Data Protection Officer where it has one.
Go deeper: GDPR compliance guide
Which terms are related to a DPIA?
- GDPRThe General Data Protection Regulation (GDPR) is the EU law, applying since 25 May 2018, that governs how organizations process the personal data of people in the EU. It requires a lawful basis, transparency and security, gives individuals rights such as access and erasure, and allows fines of up to €20 million or 4% of worldwide turnover.
- RoPAA Record of Processing Activities (RoPA) is the inventory of personal-data processing that Article 30 of the GDPR requires most organizations to keep. For each activity it records the purpose, categories of people and data, recipients, international transfers, retention periods and security measures, and it must be shown to regulators on request.
- Risk RegisterA risk register is the central record of an organization’s identified risks. Each entry describes the risk, its likelihood and impact, the resulting rating, the owner, and the treatment decision: mitigate, transfer, accept or avoid. ISO 27001, the NIST AI RMF and most other frameworks expect one, kept current and linked to controls.
- Continuous ComplianceContinuous compliance is the practice of monitoring controls and collecting evidence all the time, not just before an audit, so an organization knows its compliance posture on any given day. Integrations watch source systems, alerts fire when a control drifts, and issues are fixed close to when they occur, which matters most for SOC 2 Type II.