Assessment required for high-risk processing to identify and mitigate data protection risks.
A Data Protection Impact Assessment (DPIA) is a process for identifying and minimising data protection risks of high-risk processing activities. GDPR requires DPIAs for processing likely to result in high risk—systematic profiling, large-scale special category data, or public area monitoring. DPIAs describe processing, assess necessity and proportionality, identify risks, and define mitigations. The ICO must be consulted if high risks remain after mitigation.
Why It Matters
The DSC Perspective:
DPIAs are mandatory for high-risk processing. They also demonstrate accountability and help identify issues before they become problems. Consider DPIAs even when not legally required.