Data Protection Impact Assessment (DPIA)

A comprehensive factual account of the planned data flows. This section must articulate the nature, scope, context, and purposes of the processing.

• Data Categories: Explicitly list types of personal data (e.g., health, biometric, financial).
• Data Subjects: Identify vulnerable groups like children or employees.
• Asset Inventory: Document all systems, cloud services, and third parties touching the data.
• Retention Periods: Define specific erasure timelines per data category.

A legal and technical justification proving the processing is strictly required for the specific purpose. This is not a business case; it is a rights-versus-interests balancing test.

• Purpose Limitation: Demonstrate why less intrusive alternatives are insufficient.
• Data Minimization: Confirm only the absolute minimum necessary data is collected.
• Legal Basis: Explicitly link processing to a valid GDPR Article 6 lawful basis, such as consent or legitimate interest.

An objective evaluation of the potential physical, material, or non-material damage to individuals. This moves beyond corporate risk to focus on human impact.

• Likelihood & Severity: Score risks using a matrix that multiplies probability by impact.
• Specific Threats: Analyze risks like identity theft, financial loss, discrimination, or loss of confidentiality.
• Edge Cases: Account for data breaches, algorithmic bias, and unauthorized re-identification.

A detailed technical and organizational action plan to reduce identified risks to an acceptable residual level. Vague promises are insufficient; specific controls are required.

• Technical Controls: Specify encryption standards (AES-256), pseudonymization techniques, and access controls.
• Organizational Controls: Define staff training, confidentiality agreements, and internal audit schedules.
• Privacy by Design: Demonstrate how safeguards are embedded into the architecture, not bolted on after.

A documented record of engaging with relevant parties to inform the assessment. This is mandatory for certain high-risk scenarios.

• Data Protection Officer (DPO): Mandatory consultation and sign-off on the final report.
• Data Subjects: Record outcomes of surveys or focus groups where processing affects vulnerable populations.
• Independent Experts: Engage external engineers or ethicists for complex algorithmic systems.

The mechanism that determines if the supervisory authority must be engaged before processing begins. If residual risk remains high after mitigation, prior consultation is legally mandatory.

• Residual Risk Threshold: Define the objective criteria that trigger a mandatory filing.
• Regulatory Liaison: Prepare the formal submission package for the Lead Supervisory Authority.
• Compliance Pause: Implement a technical hold on processing until regulatory approval is granted.

A three-part balancing test conducted before processing begins to determine if the controller's interests override the rights of the data subject. While a DPIA focuses on high-risk processing, an LIA is the legal basis test required when relying on legitimate interest. The LIA documents the necessity, proportionality, and safeguards, often feeding directly into the DPIA's risk analysis section.

A mandatory inventory under GDPR Article 30 that maps all personal data flows across the organization. The RoPA serves as the discovery backbone for a DPIA by identifying:

• Categories of data subjects and personal data
• Purposes of processing
• Data recipients and third-country transfers
• Technical and organizational security measures Without an accurate RoPA, a DPIA cannot reliably assess the scope of processing risk.

An evaluation framework focused specifically on the societal and ethical consequences of automated decision systems. While a DPIA addresses data protection risks to individuals, an AIA extends the scope to include:

• Fairness and bias in model outputs
• Disparate impact on protected groups
• Transparency and explainability of automated decisions
• Human oversight adequacy Both assessments are often required in parallel for high-risk AI systems under the EU AI Act.

The automated mapping of personally identifiable information as it moves through an organization's data ecosystem. For a DPIA, data lineage provides the factual evidence of:

• Origin and collection points
• Transformation and enrichment steps
• Storage locations and retention periods
• Cross-border transfer paths This granular visibility is essential for accurately assessing the likelihood and severity of identified risks.

Technical measures that enforce data minimization by preventing the repurposing of collected data for incompatible processing activities. In the context of a DPIA, these controls demonstrate that:

• Data is only used for its declared purpose
• Function creep is technically blocked
• Access is gated by the specific processing purpose
• Re-identification attempts are logged and alerted These controls are a key mitigating measure documented in the DPIA.

The statistical probability that an attacker can successfully link de-identified or pseudonymized data back to a specific individual using auxiliary information. A DPIA must explicitly evaluate this risk by considering:

• The strength of the de-identification technique applied
• The availability of external datasets for linkage attacks
• The potential harm if re-identification occurs
• The residual risk after mitigation measures are applied