# Data protection impact assessment (DPIA)

An assessment you carry out before processing personal data in a way likely to put people at high risk, to find and reduce that risk.

Source: https://sted.digital/docs/glossary/dpia · Last reviewed 17 October 2026 · Strand Glossary

A data protection impact assessment (DPIA) is a structured assessment you carry out before starting processing that is likely to put people at high risk: what the processing does, whether it is necessary, what could go wrong for the people affected, and how you will reduce it. Privacy leads write it; data protection officers and regulators read it.

## Where the term appears

UK GDPR Article 35(1) requires a DPIA where processing is likely to result in a high risk, and UK GDPR Article 35(3) names three cases that always need one: significant decisions based on profiling, large-scale use of special category or criminal offence data, and large-scale monitoring of public areas. UK GDPR Article 35(7) sets the minimum contents. If a high risk remains after your measures, UK GDPR Article 36 requires you to consult the regulator before you start. EU GDPR Article 35 and 36 say the same. The [DPIA page](/docs/standards/gdpr/dpias) covers the regulators' lists of further triggers.

### Risk to people, not to you

An ISO 27001 risk assessment scores harm to your organisation. A DPIA scores harm to the people whose data it is: discrimination, loss of control, distress, financial loss. Auditors check the risks are written from that side, and that the assessment was dated before launch, not after.

## How Sted uses it

Sted has no DPIA record template.

## Related terms

- [Special category data](/docs/glossary/special-category-data): large-scale use is one of the commonest triggers.
- [Lawful basis](/docs/glossary/lawful-basis): the necessity test in a DPIA builds on it.
- [Data protection officer (DPO)](/docs/glossary/data-protection-officer): whose advice the DPIA must seek, if you have one.
- [Residual risk](/docs/glossary/residual-risk): what remains after your measures and decides whether you consult the regulator.
- [How to carry out a DPIA](/docs/guides/dpia): the task, step by step.