What Is a DPIA?
LawA Data Protection Impact Assessment is a structured review of the risk a specific processing activity poses to Data Principals' rights — considering the nature and purpose of the processing, the categories of data involved, and the potential harm if something goes wrong. For Significant Data Fiduciaries, Section 10 requires this be carried out periodically and reported to the Data Protection Board alongside the independent compliance audit covered in Chapter 13.
Why DPIA Matters
PracticeBeyond the SDF requirement, a DPIA forces a genuinely useful conversation before a new feature or processing activity ships: why do we need this specific data, what happens if it's misused or breached, and is there a less risky way to achieve the same goal. Running this conversation before launch is materially cheaper than discovering the same issues after a feature is live and being used by real Data Principals.
When a DPIA May Be Relevant
Beyond the SDF statutory trigger, a DPIA is worth running before: launching a new feature that collects a new category of personal data, introducing a new tracking or profiling capability, starting a new large-scale data-sharing arrangement with a third party, or processing data in a way that could plausibly affect a vulnerable group (including, notably, children — see Chapter 11).
Privacy Risk Assessment
PracticeAt its core, a DPIA is a risk assessment with a specific subject: not "what could go wrong for the business" (the usual frame of a general risk assessment) but "what could go wrong for the individual whose data this is." That reframing tends to surface different concerns than a standard security or product risk review would on its own.
Identifying Risks
- What categories of personal data does this activity involve, and how sensitive are they?
- Who could be harmed if this data were breached, misused, or inferred incorrectly, and how seriously?
- Is the processing proportionate to the purpose, or does it collect more than necessary?
- Does this activity involve automated decision-making that could affect a Data Principal without meaningful human review?
- Does it involve a vulnerable group, including children?
Risk Mitigation
Once risks are identified, the DPIA should document what mitigation is applied to each — reducing the data collected, adding stronger access controls, anonymising or pseudonymising where the purpose still works without full identifiability, or in some cases deciding not to proceed with the processing as originally scoped. Not every identified risk needs to be eliminated — some can be consciously accepted — but the assessment should make that a deliberate decision, not a gap nobody noticed.
DPIA Process
| Step | What happens |
|---|---|
| Describe the processing | What data, what purpose, what systems, who has access |
| Assess necessity and proportionality | Is this the minimum data needed for the stated purpose? |
| Identify risks | What could go wrong, for whom, and how severely |
| Apply mitigation | Reduce, safeguard, or redesign the processing |
| Document and sign off | Record the assessment, decisions made, and residual risk accepted |
A consumer app is planning a new feature that infers a user's likely location patterns from GPS data to personalise recommendations. A DPIA run before launch identifies that raw location history is more granular than the feature actually needs, that the data would be highly sensitive if breached, and that a coarser, less precise location signal would serve the same product purpose with meaningfully lower risk — leading the team to redesign the feature around the coarser signal before shipping, rather than after a privacy complaint or incident forces the same conversation later.
Documentation
PracticeA DPIA that exists only as a conversation nobody wrote down isn't much use if it's ever questioned later — by the Data Protection Board for an SDF, or simply by your own team six months on trying to remember why a particular design decision was made. A short, consistently used template (the process table above is a reasonable starting point) is more valuable than an elaborate one nobody actually completes.