AI glossary for businesses
Data protection impact assessment (DPIA)
In short
A data protection impact assessment (DPIA) is a structured risk assessment required by Article 35 of the GDPR before processing that is likely to result in a high risk to people's rights and freedoms. It describes the processing, checks that it is necessary and proportionate, assesses the risks and sets out measures to reduce them.
How a DPIA works
A DPIA is a "think before you build" exercise. Before you start a new way of using personal data, you write down what you plan to do and ask what could go wrong for the people whose data it is.
A fair analogy is a safety check on a delivery van. You do not inspect the van before every short trip, but before a long journey with a heavy load you check the brakes, tyres and lights. A DPIA is that check for data processing that carries more risk.
Under Article 35 of the GDPR, a DPIA should at least contain:
a description of the processing and its purposes;
an assessment of whether it is necessary and proportionate;
an assessment of the risks to individuals;
the measures you will take to address those risks.
The GDPR gives examples of when a DPIA is required, such as systematic and extensive profiling with significant effects on people, large-scale processing of sensitive data and large-scale monitoring of public areas. The Hellenic Data Protection Authority has also published a list of processing types that need one. If a high risk remains after your measures, you must consult the Authority before you start.
In practice for a small business
An e-shop with a large customer base wants to use AI to segment shoppers and personalise offers based on purchase history and browsing behaviour. That is profiling of personal data at scale, so a DPIA is very likely to be needed. The team would map which data feeds the model, who sees the results, how long data is kept and how customers can object. See the use case on personalized recommendations and segments.
AI in recruitment is another common trigger. It is also a high-risk AI system use under the EU AI Act, so both laws apply.
Why it matters and what to watch out for
Do it before, not after. A DPIA comes before the processing starts. Update it when the project changes.
Involve your DPO. If you have a Data Protection Officer, the GDPR requires you to seek their advice.
Ask your vendors. You need clear information on where data is stored, whether it is used for training and which subprocessors are involved.
Not legal advice. Whether you need a DPIA depends on the details. Check with your DPO or legal advisor.