Data protection impact assessment

In short: A data protection impact assessment (DPIA) examines in advance what risks a planned processing operation poses to the data subjects’ rights if the risk is likely to be high.

In more detail: It is mandatory for systematic monitoring, extensive processing of special categories of data or new technologies with high risk. It describes the processing, assesses necessity and risks and defines safeguards.

In Depth

• When: Supervisory authorities publish lists of processing operations for which a DPIA is needed.
• Content: description, purpose, necessity, risks, measures.
• Result: If a high residual risk remains, the supervisory authority must be consulted beforehand.
• In practice: For a small project with few, uncritical data it is usually not needed, but a short risk assessment helps.

See also: Record of processing activities, Privacy by design