Data protection impact assessment
DPIAAlso called privacy impact assessment, PIA
A data protection impact assessment is a documented review of how a planned use of personal data could harm people, and how the firm will reduce that risk. Under the GDPR and UK GDPR it is required before processing likely to result in high risk, such as large-scale profiling or new AI tools.
How it works
A project team screens new systems for high-risk processing. If a DPIA is needed, it describes the data, purpose and flows, tests necessity and proportionality, and scores risks to individuals. The data protection officer gives advice. Agreed controls are recorded, and if high risk remains the firm consults the supervisory authority before going live.
For banks and insurers, DPIAs cover fraud models, transaction monitoring, biometric onboarding and AI tools that profile customers. A missing or weak DPIA is a common finding in data protection enforcement. The EU AI Act also points deployers of high-risk AI to their DPIA, so privacy and AI governance teams increasingly run the two together.
The rules
Requires a DPIA before processing likely to result in high risk to individuals, including systematic profiling and large-scale special category data.
Controllers processing personal data in the EUSets nine criteria for spotting high-risk processing and was endorsed by the EDPB on 25 May 2018.
Controllers under the GDPRKeeps the DPIA duty in UK law after Brexit, with the UK data protection regulator publishing a list of processing that needs one.
Controllers processing personal data in the UKCommon questions
When is a DPIA mandatory?
The GDPR requires one when processing is likely to result in high risk to individuals. Examples include systematic and extensive profiling with significant effects, large-scale processing of special category or criminal data, and large-scale monitoring of public areas. Regulators publish lists of further cases.
What happens if high risk remains after a DPIA?
The controller must consult the data protection authority before starting the processing. The authority can give written advice and use its powers, including banning the processing, if it finds the risk is not properly addressed.
Is a DPIA the same as an AI risk assessment?
No. A DPIA covers risks to people from personal data processing. An AI risk assessment also covers accuracy, robustness and bias. Under the EU AI Act, deployers of high-risk AI use provider information to complete their DPIA.
Who carries out the DPIA?
The controller is responsible. In practice the project owner leads it, with advice from the data protection officer and input from security, legal and the business.
Our coverage
News and analysis on AI and model risk from RegTech Post.
Read the coverage →RegTech PostGDPR Tech Stack: Tools Powering Privacy in the Corporate WorldRead the article →RegTech PostGDPR Compliance Officer: Tools, Strategies, and Day-to-Day WorkRead the article →
