DPIA (data protection impact assessment)
Also called data protection impact assessment, PIA.
An assessment the GDPR requires before processing personal data in ways likely to put people's rights at high risk.
Last updated
What it is.
GDPR Article 35 requires the controller to carry out a DPIA before processing that is likely to result in a high risk to people. It is required in particular for systematic and extensive automated evaluation of people, including profiling, that leads to decisions with legal or similarly significant effects; large-scale processing of special categories of data such as health data; and large-scale systematic monitoring of public areas.
A DPIA describes the processing, checks that it is necessary and proportionate, assesses the risks to people, and sets out the measures to reduce them. National regulators also publish lists of processing that needs one.
Why it matters
A DPIA done early changes the design, not just the paperwork. It is where teams decide to collect less data, add human-in-the-loop review to automated decisions, or keep data in a narrower place. Many AI features that score or rank people will need one.
In a product build
For a product build with profiling, health data or automated decisions, the DPIA belongs in discovery, so its outcomes become scoped features rather than late change requests.
Common mistakes.
- 01
Doing it after launch to tick a box.
- 02
Assessing risk to the company instead of risk to the people whose data it is.
- 03
Never revisiting it when the processing changes, for example when a new AI feature is added.
Read the official text.
Primary sources this definition is based on.
- Regulation (EU) 2016/679, the GDPR (Official Journal)checked 2026-10-25
Work it out with a tool.
Related terms.
- Lawful basis (GDPR)One of the six reasons listed in GDPR Article 6 that make processing personal data lawful, such as consent or a contract.
- Data controller (GDPR)Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others.
- High-risk AI system (EU AI Act)An AI system the EU AI Act places in its high-risk class, which brings extra duties before and after it is placed on the market.
- Human-in-the-loop (HITL)A design where a person reviews, corrects or approves what an AI system produces before it takes effect.
Guides and pages
Browse the full glossary or read answers to common questions.
