DPIA

What it means

A DPIA assesses the impact of processing on data protection. GDPR requires one where risk to people’s rights is high: large-scale profiling, monitoring of premises, sensitive data, new technologies.

It is not a one-page form. It examines the purpose and necessity of the processing, the risks to the people involved and the measures reducing them, including pseudonymisation and retention periods.

It is not the same as the record of processing activities. The record lists every processing operation in the company, briefly, and is required of almost everyone, whereas a DPIA goes deep into one specific high-risk operation and explains why it is proportionate.

How it works in practice

In company practice it is usually triggered by CCTV, employee monitoring or a larger marketing system with profiling. It is done before launch, alongside the processor agreement.

It normally includes a review of access rights and the question of who actually reaches the data. That question most often reveals the system collects more than anyone needs.

A typical case in a smaller company is an attendance system using fingerprints or face recognition. Biometric data is a special category, and the assessment often shows that a chip card, needing no sensitive data at all, is perfectly adequate for attendance records.

What to watch out for

If the assessment leaves a high residual risk that cannot be mitigated, the processing must be consulted with the supervisory authority. Launching anyway earns a sanction for the procedure itself, not for a breach.

An assessment is not a one-off. When the company extends the system, adds new data or moves processing to a cloud provider outside the EU, the original DPIA no longer reflects reality, and an inspection looks at the situation as it is now, not as it was at launch.