DPIA
Data Protection Impact Assessment — a systematic process to identify and minimise privacy risks in new processing activities.
Full Definition
A Data Protection Impact Assessment (DPIA) is a formal process used to identify, assess, and mitigate privacy risks before commencing processing activities that are likely to result in a high risk to individuals. Under GDPR Article 35, DPIAs are mandatory for processing that is likely to result in high risk — including large-scale processing of sensitive data, systematic monitoring, and use of new technologies. A DPIA must describe the processing, assess necessity and proportionality, identify risks to data subjects, and document measures to address those risks. If residual risks remain high, a controller must consult their supervisory authority before processing.
How each law treats it
Required before processing where processing 'is likely to result in a high risk' to data subjects. The EDPB's nine-criteria test — meeting two criteria usually triggers the obligation.
Mandatory for Significant Data Fiduciaries. The DPDP Rules 2025 specify the DPIA's scope and the independent-audit touchpoint.
Required for new technologies, large-scale sensitive-data processing, and processing likely to result in a high risk to data subjects.
In practice
- Start the DPIA before processing begins. Retrospective DPIAs are evidence that the obligation was missed, not that it was met.
- Include the DPO's advice as a documented step. Articles 35(2) and 39(1)(c) require it.
- Prior consultation under GDPR Article 36 is required if a residual high risk remains after mitigation — plan the regulator conversation into the project timeline.
Common pitfalls
- Treating the DPIA as a tick-box. Supervisory authorities read them, and a thin DPIA is often the trigger for an inquiry.
- Running a DPIA without consulting data subjects where appropriate. Article 35(9) requires it where appropriate — the authority will ask whether you did.
- Mixing DPIAs with GDPR legitimate-interests balancing tests. They aren't the same instrument.
Frequently asked questions
When exactly do I need a DPIA?+
When processing is likely to result in a high risk to the rights and freedoms of data subjects. The EDPB publishes a nine-criteria test — meeting two usually triggers the obligation. Local DPAs maintain their own lists of DPIA-mandatory activities.
What's the difference between a DPIA and an LIA?+
A Legitimate Interests Assessment (LIA) justifies the choice of Article 6(1)(f) as the lawful basis. A DPIA assesses the risk of the processing itself. They often overlap and are frequently filed together, but they are not substitutes.
Does the DPIA cover the EU AI Act's FRIA?+
Not fully. A Fundamental Rights Impact Assessment (FRIA) is the AI Act's equivalent instrument for public-sector deployers and some private-sector use cases. Most organisations run DPIAs and FRIAs together using a shared template.
Related terms
Data Controller
An entity that determines the purposes and means of processing personal data.
Privacy Impact Assessment
A process to systematically identify and address privacy risks in a project, system, or business process.
Lawful Basis
A legal justification under GDPR for processing personal data — one of six bases must apply before processing can begin.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes