GDPR Q48

What is a privacy impact assessment?

Q48. What is a privacy impact assessment?

Category: Assessments

A privacy impact assessment (another term for DPIA) evaluates privacy risks in projects that involve personal data.

In simple terms

Identify risks early and plan mitigations.
Consult stakeholders and document decisions.
Review and update the assessment throughout the project lifecycle.

When to run an assessment

Use DPIAs for new technologies, large-scale monitoring, or processing special category data. Even if not legally required, they provide valuable insight.

Screen projects early using a DPIA checklist.
Consider cumulative risk when combining datasets.
Document reasons if you decide a full DPIA is unnecessary.

Key components

Describe the processing, assess necessity and proportionality, identify risks, and plan controls. Seek views from data subjects or their representatives where appropriate.

Assign owners for each mitigation measure.
Set review dates and triggers for updating the DPIA.
Consult the ICO if high risks remain.

Practical steps to take

Use a DPIA template to capture consistent information.
Engage privacy, security, legal, and operational teams.
Record risk ratings and mitigation plans.
Monitor implementation of agreed controls.
File the completed DPIA in your accountability records.

Real-life examples

Smart building sensors

A property manager assesses privacy impacts of occupancy sensors and implements anonymisation and signage.

Customer analytics

A retailer conducts a DPIA for a new profiling tool, balancing insights with transparency and opt-out options.

Helpful reminders

DPIAs are living documents—update them when processes change.
Keep evidence of approvals and decision-makers.
Share relevant findings with project teams so controls are implemented.

Key takeaway

Treat DPIAs as a core project activity—they highlight risks and build trust with regulators and customers.

Article references

Article 35 – Data protection impact assessment