Data Protection Impact Assessment (DPIA)

A DPIA is legally required under Article 35 of the GDPR when processing is likely to result in a high risk to individuals. This is not optional for experimental analytics.

• Systematic profiling with legal or significant effects
• Large-scale processing of special categories of data (health, biometrics)
• Systematic monitoring of public areas (CCTV, geolocation)
• Innovative technology combined with sensitive data (e.g., ML on patient records)

The DPIA must rigorously justify why the processing must occur and how it is limited to the minimum necessary scope. It bridges legal compliance with data science architecture.

• Defines the specific purpose and rejects data repurposing
• Evaluates if less intrusive alternatives (e.g., synthetic data) can achieve the goal
• Documents retention periods and anonymization timelines
• Ensures alignment with the core principle of data minimization

The assessment must map specific threats to individual autonomy, focusing on tangible harms rather than abstract privacy violations.

• Physical harm: Risk of doxxing or stalking from location leaks
• Financial loss: Identity theft via re-identification of pseudonymized records
• Discrimination: Algorithmic bias in profiling leading to denied services
• Loss of confidentiality: Exposure of trade union membership or sexual orientation

The DPIA must prescribe concrete engineering solutions that reduce identified risks to an acceptable residual level before processing begins.

• De-identification pipelines: Implementing k-anonymity or differential privacy
• Pseudonymization: Separating direct identifiers from payload data
• Access controls: Role-based access with attribute-based encryption
• Data-at-rest encryption: AES-256 with secure key management
• Audit logging: Immutable logs for all data accesses

The DPIA process requires input from multiple roles to ensure no blind spots exist in the risk analysis.

• Data Protection Officer (DPO): Mandatory advisor and reviewer
• Data subjects or representatives: Required to gather views on intended processing where appropriate
• ML Engineers: Provide technical feasibility of privacy-enhancing technologies
• Security Architects: Validate threat models and attack vectors

If the DPIA identifies high residual risk that cannot be mitigated by available technologies, the controller must consult the supervisory authority before processing.

• Occurs when mitigations are insufficient or absent
• Requires submission of the full DPIA to the regulator
• The authority has 8 weeks (extendable by 6) to issue written advice
• Failure to consult when required can result in fines up to €10 million or 2% of global turnover