Data Protection Impact Assessment (DPIA)
Introduction
A Data Protection Impact Assessment, also called a DPIA is a process required under Article 35 of the GDPR to help organizations identify and minimize the data protection risks of high-risk processing activities. It is especially important when using new technologies or handling sensitive data at scale. A DPIA ensures that privacy risks are assessed before processing begins and that appropriate safeguards are in place to protect individuals’ rights and freedoms.
A DPIA is necessary when data processing is likely to result in a high risk to individuals’ rights and freedoms—such as when using automated decision-making, profiling, large-scale processing of sensitive data, or systematic monitoring of public spaces. It is required before such processing begins to ensure risks are identified and mitigated in advance. The purpose of a DPIA is not only to protect individuals but also to help organizations demonstrate GDPR compliance, avoid legal or reputational harm, and implement privacy-by-design principles from the outset.
A DPIA is required when:
- System is used for systematic monitoring in a work environment, especially if used at scale
- AI is involved
- There is a potential risk to individuals' rights
As a rule of thumb, we advise deployers to conduct a DPIA. Please refer to the additional documentation, which includes a sample and a template specifically designed for Safety AI deployments.