GDPR Q17

What is a Data Protection Impact Assessment (DPIA)?

Q17. What is a Data Protection Impact Assessment (DPIA)?

Category: Assessments

A Data Protection Impact Assessment (DPIA) helps you identify and reduce privacy risks before launching high-risk processing.

In simple terms

Required when processing is likely to result in high risk to individuals.
Assess risks, document mitigations, and consult the ICO if risk remains high.
Build DPIAs into project management from the start.

When to carry out a DPIA

Article 35 lists examples such as large-scale monitoring, processing special category data, or using new technologies. The ICO also publishes a list of operations that always require a DPIA.

Consider whether profiling, tracking, or automated decisions are involved.
Assess cumulative risk when multiple low-risk activities combine.
If unsure, complete a DPIA anyway—it demonstrates accountability.

Contents of a DPIA

Describe the processing, explain necessity and proportionality, identify risks, and set out measures to address them. Involve stakeholders, including your DPO if you have one.

Record the lawful basis and how you comply with data minimisation.
Plan security controls, staff training, and supplier checks.
Document residual risks and who approved the outcome.

Practical steps to take

Screen new projects to see if a DPIA is needed.
Gather input from technical, legal, and business teams.
Assess necessity, proportionality, and alternatives.
List risks and choose controls to reduce them.
Review regularly—especially if the project changes.

Real-life examples

Smart CCTV rollout

A council plans to deploy analytics-enabled CCTV. The DPIA explores privacy risks, sets retention rules, and ensures signage informs the public.

Health research app

A university app collects biometric data. The DPIA records consent processes, encryption measures, and data-sharing agreements with partners.

Helpful reminders

Consult the ICO if high risks remain after mitigation.
Store DPIAs securely but make summaries available when appropriate.
Update DPIAs when technology or purpose changes.

Key takeaway

DPIAs help you spot problems early—treat them as a planning tool, not a tick-box exercise.