The data protection impact assessment, or DPIA, is specified by Article 35 of the GDPR. The DPIA is performed exclusively on a single and specific processing activity that could result in high risk to the rights and freedoms of natural persons also called data subjects. The DPIA aims to identify and quantify potential high risks for the data subjects prior to the processing of the activity. Since it is an element of the GDPR, whose main core value is the preservation of the rights and freedom of the data subjects, the data protection impact assessment does not take into consideration in any shape or form the risks that the organization may face.

A data protection impact assessment is needed when the manual or automated collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data (aka “processing activity”) is likely to result in a high risk to the rights and freedoms of natural persons. It should be carried out prior to processing or in the design phase of a new technology and on a regular basis (audit) thereafter.