What is a data protection impact assessment?
A data protection impact assessment, or DPIA, is a structured process for evaluating personal-data processing that may create a high risk to individuals. It describes the proposed activity, tests whether the processing is necessary and proportionate, identifies potential harm and records the safeguards selected to reduce that risk.
A DPIA is more than a compliance form. It is a decision-making process that should involve business, privacy, legal, security and technical stakeholders before the processing is finalised. The assessment creates evidence that alternatives and impacts were considered.
When is a DPIA needed?
The precise legal threshold depends on the applicable law, but common triggers include large-scale sensitive data, systematic monitoring, profiling, automated significant decisions, biometrics, vulnerable people and innovative technology. A combination of factors can create high risk even when no single trigger is decisive.
Organisations often use an initial screening questionnaire to determine whether a full DPIA is required. The reasoning should be recorded when the conclusion is that no assessment is needed.
What should a DPIA contain?
The assessment should describe the purpose, scope, data, systems, people, recipients, retention and data flows. It should evaluate lawful basis, necessity, proportionality, transparency, rights, security and relevant expectations. Risk scenarios should focus on consequences for individuals, not only organisational loss.
For each risk, the DPIA should record existing controls, additional actions, owners, deadlines and residual risk. Consultation with affected groups or specialists may be appropriate for complex or sensitive projects.
What happens after the DPIA is completed?
The responsible owner should approve the assessment and complete required actions before launch. If high residual risk remains, additional escalation or regulator consultation may be required depending on the law. The DPIA should be reviewed when the purpose, data, technology, recipients or scale changes.
Monitoring should confirm that the controls described in the assessment actually operate. A completed document that is disconnected from implementation does not provide meaningful protection.
Frequently asked questions
Is a DPIA required for every new project?
No. It is generally required for likely high-risk processing, although a lighter privacy review may be useful for other projects.
Who completes the DPIA?
The business owner should provide the operational information, supported and challenged by privacy, legal, security and technical specialists.
Can a vendor provide the DPIA?
A vendor can provide evidence, but the deploying organisation must assess its own purpose, configuration, users and context.
Is a DPIA the same as a security assessment?
No. Security is one part. A DPIA also covers necessity, fairness, transparency, rights and wider impacts on individuals.
How often should a DPIA be reviewed?
It should be reviewed after material changes, incidents or new evidence and periodically for ongoing high-risk processing.