A data protection impact assessment (DPIA) is a documented review of a planned processing activity that identifies risks to individuals and the measures that will reduce them, carried out before the processing starts.

When it is required

GDPR and UK GDPR, Article 35 require a DPIA where processing is likely to result in a high risk to individuals' rights and freedoms. Article 35(3) names three cases that always need one:

  • Systematic and extensive evaluation of people, including profiling, that leads to decisions with legal or similarly significant effects
  • Large-scale processing of special category data or criminal offence data
  • Systematic monitoring of a publicly accessible area on a large scale

Supervisory authorities also publish their own lists of processing that needs a DPIA.

What it contains

At minimum, a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to individuals, and the measures planned to address them. If high risk remains after those measures, Article 36 requires prior consultation with the supervisory authority.

Similar assessments elsewhere

Other laws use comparable tools. The 2026 CCPA regulations require risk assessments for significant-risk processing, and Canada's proposed Bill C-36 would require privacy impact assessments before relying on legitimate interests or transferring data outside Canada.