Data protection impact assessment (DPIA)
A data protection impact assessment (DPIA) is a structured assessment you carry out before starting processing that is likely to put people at high risk: what the processing does, whether it is necessary, what could go wrong for the people affected, and how you will reduce it. Privacy leads write it; data protection officers and regulators read it.
- Short form
- DPIA
- Clauses
- UK GDPR Article 35(1) · UK GDPR Article 35(3) · UK GDPR Article 35(7) · UK GDPR Article 36 · EU GDPR Article 35
Where the term appears
UK GDPR Article 35(1) requires a DPIA where processing is likely to result in a high risk, and UK GDPR Article 35(3) names three cases that always need one: significant decisions based on profiling, large-scale use of special category or criminal offence data, and large-scale monitoring of public areas. UK GDPR Article 35(7) sets the minimum contents. If a high risk remains after your measures, UK GDPR Article 36 requires you to consult the regulator before you start. EU GDPR Article 35 and 36 say the same. The DPIA page covers the regulators’ lists of further triggers.
Risk to people, not to you
An ISO 27001 risk assessment scores harm to your organisation. A DPIA scores harm to the people whose data it is: discrimination, loss of control, distress, financial loss. Auditors check the risks are written from that side, and that the assessment was dated before launch, not after.
How Sted uses it
- Sted has no DPIA record template.
Related terms
- Special category data: large-scale use is one of the commonest triggers.
- Lawful basis: the necessity test in a DPIA builds on it.
- Data protection officer (DPO): whose advice the DPIA must seek, if you have one.
- Residual risk: what remains after your measures and decides whether you consult the regulator.
- How to carry out a DPIA: the task, step by step.