Glossary
Data protection impact assessment (DPIA)
A documented assessment of processing likely to result in a high risk to individuals, required by GDPR Article 35 before processing starts.
A data protection impact assessment (DPIA) is required under Article 35(1) GDPR where a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons. Article 35(3) lists cases where a DPIA is always required, including large-scale processing of special categories of data and systematic monitoring of a publicly accessible area on a large scale. Supervisory authorities publish national lists of operations requiring a DPIA under Article 35(4).
Article 35(7) sets the minimum content: a systematic description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to data subjects, and the measures envisaged to address those risks. The controller must seek the advice of the DPO (Article 35(2)). Where residual risk remains high, Article 36 requires prior consultation with the supervisory authority.
Security teams contribute threat models, control descriptions and residual risk ratings, but the risk being assessed is risk to individuals, not to the company. Projects such as new SIEM, DLP or employee monitoring tools frequently meet the WP248 criteria that trigger a DPIA. See our guide to DPIAs for IT projects.