Glossary · Privacy and data protection
A DPIA tests a risky idea before the data starts moving.
A documented assessment of a planned use of personal data that is likely to put people's rights at high risk, done before the processing begins.
Back to the glossary01 · In plain words
In plain words
A documented assessment of a planned use of personal data that is likely to put people's rights at high risk, done before the processing begins.
A data protection impact assessment (DPIA) asks four things about a new plan: what will happen to the data, whether it is necessary and proportionate, what could harm the people involved, and what will reduce that harm. It is a GDPR idea, from Article 35. India's DPDP Act borrows it, but only for significant data fiduciaries.
Spelled out: Data protection impact assessment.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Under the GDPR, a controller must carry out a DPIA before processing that is likely to result in a high risk. Article 35 names three cases that always need one: systematic and extensive profiling with legal or similar effects, large-scale use of special category or criminal-offence data, and large-scale systematic monitoring of a public area. Supervisory authorities publish their own lists too. If high risk remains after mitigation, Article 36 says to consult the authority first. Under the DPDP Act, section 10 requires a significant data fiduciary to run periodic DPIAs, and Rule 13 sets that at once every twelve months, with significant observations reported to the Board.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- A product design review
- The point where a new feature using personal data is approved, or sent back for a DPIA.
- The DPIA register
- A list of assessments, their outcomes, owners and review dates, which a regulator may ask to see.
- DPO advice
- Under the GDPR the controller must seek the DPO's advice when carrying out a DPIA.
- A significant fiduciary's annual report
- Under the DPDP Rules, the assessor's significant observations go to the Board.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a gym chain adds face recognition at the door
A gym chain with members in Ireland plans to replace key cards with face scans. Biometric data used to identify people is special category data, and the scans run at scale, so a DPIA is clearly required. The assessment asks whether a card or PIN would do the same job, and offers members an alternative entry method. It records storage limits, who can see templates, and a decision to hold templates on the device at each branch rather than centrally.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Risk assessment
- An ISO 27001 risk assessment looks at risks to the organisation's information. A DPIA looks at risks to the people the data is about.
- AI impact assessment
- Looks at an AI system's effects on people and society. It can share work with a DPIA but has a wider scope.
- Transfer impact assessment
- Checks whether a destination country's laws undermine a GDPR transfer tool. It is a separate exercise.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Add a DPIA screening question to your product and vendor intake process.
- Use one template that covers description, necessity, risks to people and measures.
- Keep the DPO's advice and the decision on record, with a review date.
- If you could be notified as a significant fiduciary in India, plan for a yearly cycle.
- GuideData protection impact assessmentsWhen a DPIA is mandatory, and what it must contain.
- GuideSignificant data fiduciariesThe extra duties: DPO, audits and impact assessments.
Sources: Regulation (EU) 2016/679, Articles 35 and 36; Digital Personal Data Protection Act, 2023, section 10; Digital Personal Data Protection Rules, 2025, rule 13. Not legal advice.
Questions about DPIA
Does every DPDP fiduciary need a DPIA?
No. The Act requires it of significant data fiduciaries.
Section 10 places the DPIA duty on significant data fiduciaries only. Other fiduciaries can still run one as good practice, and it is often the easiest way to show a considered decision.
Is a DPIA something you submit to the regulator?
Not routinely under the GDPR.
Under the GDPR, a DPIA stays on file unless high risk remains and you must consult the authority under Article 36. Under the DPDP Rules, a significant fiduciary's assessor reports significant observations to the Board.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.