Data Protection Impact Assessments and Risk Management
What to know
A DPIA is a structured risk assessment for processing likely to result in high risk to individuals. Triggers include systematic and extensive evaluation, large-scale special-category data, systematic monitoring of a publicly accessible area, and novel technologies. Know the DPIA lifecycle: description of processing and necessity/proportionality, consultation with the DPO, assessment of risks to rights and freedoms, mitigations, sign-off, and review. Understand the difference between risk to the organisation and risk to individuals, and when prior consultation with the regulator is required because residual risk remains high.
Traps
- Treating a DPIA as a one-off document rather than a living record reviewed when processing changes.
- Assessing only organisational risk (reputational, financial) and ignoring harm to individuals.
- Assuming a DPIA is optional because the project is internal, or that a security risk assessment substitutes for it.
- Skipping stakeholder or data subject consultation where appropriate.
- Failing to document why a risk was accepted and who approved it.
Worked example
A hospital plans AI triage software using patient records. Rule of thumb: high-risk triggers present → DPIA required before processing. Steps: describe data flows, assess necessity and proportionality, identify harms (misdiagnosis, bias, loss of confidentiality), set mitigations (human review, bias testing, access controls, retention limits), record residual risk, obtain DPO advice and sign-off, schedule review.
Rule of thumb
If residual high risk cannot be mitigated, consult the regulator before proceeding; otherwise proceed with documented acceptance and monitoring.