{"head":{"title":"What Is a DPIA (Data Protection Impact Assessment)?","description":"A DPIA is the GDPR assessment of a high-risk use of personal data, done before processing starts. When Article 35 requires one and what it covers.","canonical":"https://oceanlab.in/glossary/dpia"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"DPIA","path":"/glossary/dpia"}],"slug":"dpia","term":"DPIA (data protection impact assessment)","aka":["data protection impact assessment","PIA"],"category":"Compliance","short":"An assessment the GDPR requires before processing personal data in ways likely to put people's rights at high risk.","body":[["GDPR Article 35 requires the ",{"href":"/glossary/data-controller","text":"controller"}," to carry out a DPIA before processing that is likely to result in a high risk to people. It is required in particular for systematic and extensive automated evaluation of people, including profiling, that leads to decisions with legal or similarly significant effects; large-scale processing of special categories of data such as health data; and large-scale systematic monitoring of public areas."],["A DPIA describes the processing, checks that it is necessary and proportionate, assesses the risks to people, and sets out the measures to reduce them. National regulators also publish lists of processing that needs one."]],"why":["A DPIA done early changes the design, not just the paperwork. It is where teams decide to collect less data, add ",{"href":"/glossary/human-in-the-loop","text":"human-in-the-loop"}," review to automated decisions, or keep data in a narrower place. Many AI features that score or rank people will need one."],"example":["A lender plans an AI model that pre-screens loan applications. Because it is automated evaluation with significant effects, the team runs a DPIA. The result: applicants are told a model is used, any rejection is reviewed by a person, and the model does not see certain fields."],"inBuild":["For a product build with profiling, health data or automated decisions, the DPIA belongs in discovery, so its outcomes become scoped features rather than late change requests."],"mistakes":[["Doing it after launch to tick a box."],["Assessing risk to the company instead of risk to the people whose data it is."],["Never revisiting it when the processing changes, for example when a new AI feature is added."]],"related":[{"href":"/glossary/lawful-basis","label":"Lawful basis (GDPR)","detail":"One of the six reasons listed in GDPR Article 6 that make processing personal data lawful, such as consent or a contract."},{"href":"/glossary/data-controller","label":"Data controller (GDPR)","detail":"Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others."},{"href":"/glossary/high-risk-ai-system","label":"High-risk AI system (EU AI Act)","detail":"An AI system the EU AI Act places in its high-risk class, which brings extra duties before and after it is placed on the market."},{"href":"/glossary/human-in-the-loop","label":"Human-in-the-loop (HITL)","detail":"A design where a person reviews, corrects or approves what an AI system produces before it takes effect."}],"tools":[{"href":"/tools/eu-ai-act-risk-checker","label":"EU AI act risk checker","detail":"Free tool"}],"links":[{"href":"/compliance/gdpr","label":"GDPR guide","detail":"Who the GDPR applies to and what it asks of software."},{"href":"/compliance/eu-ai-act","label":"EU AI Act guide","detail":"Risk classes, duties and the current dates."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."}],"sources":[{"title":"Regulation (EU) 2016/679, the GDPR (Official Journal)","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}