What is DPIA (Data Protection Impact Assessment)?

The DPIA is GDPR's mechanism for forcing risk analysis before the fact. It is mandatory where processing is 'likely to result in a high risk to the rights and freedoms of natural persons,' with three named triggers: systematic and extensive automated evaluation or profiling producing significant effects; large-scale processing of special-category or criminal data; and systematic large-scale monitoring of publicly accessible areas. Supervisory authorities publish supplementary lists — new technologies, data matching, tracking of vulnerable people, and combinations of risk factors commonly appear.

A compliant DPIA contains four elements: a systematic description of the processing and its purposes (including legitimate interests pursued), an assessment of necessity and proportionality, an assessment of the risks to data subjects, and the measures envisaged to address those risks and demonstrate compliance. Where a DPO is appointed, their advice must be sought; where residual risk remains high after mitigation, the controller must consult the supervisory authority before proceeding.

In practice, DPIAs work best as a screening-plus-deep-dive pipeline: a lightweight threshold assessment on every new project, tool, or campaign determines whether a full DPIA is needed, so the heavyweight process is spent only on genuinely risky processing. The DPIA is a living document — revisited when the processing changes — and a keystone of the accountability principle: it is the artifact you produce when a regulator asks 'show me you thought about this.'

US law is converging: Virginia, Colorado, Connecticut, and other state statutes require 'data protection assessments' for targeted advertising, sales of data, profiling, and sensitive-data processing — narrower documents than a GDPR DPIA, but the same discipline.