Data Protection Impact Assessments and Risk Management
A DPIA is a structured risk assessment for processing likely to result in high risk to individuals. Triggers include large-scale special category data, systematic monitoring, innovative technology, profiling with significant effects, and combining datasets. The DPIA should describe the processing, assess necessity and proportionality, identify risks to individuals, and set out mitigations. Where residual risk remains high, the organisation must consult the regulator before proceeding.
Distinguish risk to the organisation (reputational, financial) from risk to individuals (harm from loss of control, discrimination, distress). DPIAs are about the latter. Use a consistent likelihood × severity method and record the residual risk after controls.
Traps
- Treating a DPIA as a one-off. It must be reviewed when processing changes.
- Confusing a DPIA with a security risk assessment or a vendor questionnaire.
- Forgetting the prior consultation step when residual risk stays high.
- Assuming a DPIA is required for all processing - it is risk-triggered.
Rule of thumb
If you cannot describe the harm to individuals in one sentence, the DPIA is incomplete. If that harm remains high after mitigations, consult the regulator.
Worked example: A hospital deploys AI triage. High-risk triggers apply (health data, innovative tech, significant effects). The DPIA documents bias testing, human oversight, and retention limits; residual risk is judged medium after controls, so no prior consultation is needed - but a review is scheduled annually.