Governance, Law & Compliance
Data protection impact assessment
DPIA
A structured privacy review for processing activities that may create high risks to individuals.
Example
A privacy team documents risks before launching automated analysis of employee communications.
Why it matters
It helps teams identify and reduce serious privacy risks before people are affected.
You'll hear it
“Can we meet the goal without collecting that sensitive information?”
Can you control it?
Sometimes
Sometimes. An organization can define or influence a data protection impact assessment through its policies, processes, contracts, and product choices. Individual users may have fewer controls.
Common questions
- Is it the same as a security assessment?
- No. Security matters, but privacy also concerns why information is used and how that use affects people.
- Does completing the form automatically authorize the project?
- No. The findings may require changes or further action under the applicable rules.
- Should it be updated when the project changes?
- Significant changes to the information, purpose or risks can call for another review.