Data protection impact assessment (DPIA)
Definition
A documented assessment of processing likely to result in high risk to individuals, describing the processing, its necessity and proportionality, the risks and the measures to address them.
A DPIA is required under GDPR Art. 35 before processing that is likely to result in a high risk, notably systematic and extensive evaluation of people based on automated processing, large-scale processing of special categories, and large-scale systematic monitoring of public areas. Supervisory authorities publish lists of further cases. The DPIA must describe the processing and purposes, assess necessity and proportionality, assess risks to rights and freedoms and set out mitigating measures. The DPO must be consulted, and if high residual risk remains, the authority must be consulted before starting.
The LGPD equivalent is the relatório de impacto à proteção de dados pessoais (RIPD), defined in Art. 5, XVII, which the ANPD may request, including when processing relies on legitimate interest (Art. 38).
Most AI systems that profile people or make significant decisions about them call for a DPIA. Under the EU AI Act, deployers of certain high-risk systems also perform a fundamental rights impact assessment, which can build on the DPIA rather than duplicate it.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 3: Accountability tools.
Also covered in: Responsible AI Practitioner (RAIP), Responsible AI Auditor (AUDAI)
Primary sources
- GDPR Art. 35
- LGPD Art. 5, XVII and Art. 38
- WP29/EDPB Guidelines on DPIA (WP248 rev.01)