Glossary A–ZLetter D
Data protection impact assessment
A data protection impact assessment, or DPIA, is a prior review of the risks a data processing operation poses for the people concerned and how those risks are reduced.
The GDPR requires one under Article 35 where processing is likely to result in a high risk.
The assessment describes the planned processing, justifies its necessity, evaluates the risks and sets out safeguards. Supervisory authorities publish lists of processing operations for which a DPIA is always required. With screens, it becomes relevant above all for cameras and sensors. According to guidance from the German supervisory authorities, it is mandatory in advance for advertising and marketing measures using facial recognition software, for example.
A DPIA is not a form to be filled in once. It must be completed before the start and reviewed whenever the processing changes, for example through new software in the sensor. If a high risk remains after all measures, the supervisory authority must be consulted beforehand. Operators should involve the data protection officer early; this glossary is not legal advice.