If you’ve heard the term “DPIA” and quietly hoped it didn’t apply to you, you’re not alone. It sounds technical, but the idea is simple. A DPIA is a way of thinking through the risks to people’s data before you start using their personal data in a new or sensitive way.
What is a DPIA?
DPIA stands for Data Protection Impact Assessment. It’s a structured review, required by the GDPR, that helps you spot and reduce privacy risks before a project goes live. Think of it as a risk assessment but focused on the people whose data you handle rather than on your business.
A DPIA isn’t about getting a pass or fail. It’s about showing you’ve thought about what could go wrong for individuals, and what you’re doing to prevent it. We like to think of it as an insurance policy for any future issues that arise.
When do you need one?
You need a DPIA whenever your processing is likely to result in a high risk to people’s rights and freedoms. GDPR gives three clear examples:
Using automated decision-making or profiling that significantly affects people, such as screening job applicants or assessing credit
Processing sensitive data (health, biometrics, criminal records) on a large scale
Systematically monitoring a public space on a large scale, for example with CCTV
The Data Protection Commission (DPC) has also published its own list of activities that need a DPIA. It includes tracking people’s location or behaviour, using biometric data, combining large datasets from different sources, and using new technology such as AI tools. As a rule of thumb, if your project ticks two or more of these boxes, you should assume a DPIA is needed.
Some everyday examples
DPIAs aren’t just for big tech. We see them come up for:
A clinic introducing a new app for patient records
A business rolling out workplace monitoring or GPS tracking of staff vehicles
A company using an AI tool to rank or filter CVs
Sensitive data at scale, a charity that deals with data about children, or other special category data.
If you’re unsure whether your plans are “high risk”, it’s safer to do the assessment than to guess.
What does a DPIA involve?
It doesn’t have to be a 50-page report. A good DPIA covers four things:
What you’re doing, including what data, whose data, why, and for how long
Why it’s necessary and whether there’s a less intrusive way to achieve the same goal
The risks to individuals, such as loss of control over their data, discrimination, or harm if there’s a breach
How you’ll reduce those risks, for example through encryption, access controls, shorter retention, or clearer notices
Crucially, it needs to be done before you start processing, not after. A DPIA done retrospectively is a lot less useful, and a lot harder to defend.
What if the risk is still high?
Sometimes, even after you’ve put safeguards in place, a high risk remains. In that case you must consult the DPC before going ahead. Your DPIA is what shows them you’ve done your homework.
What happens if you skip it?
Failing to carry out a DPIA when one is required can lead to fines etc., but beyond the fine, it leaves you exposed if something goes wrong, because you can’t show you ever considered the risks.
The bottom line
A DPIA is a risk check on how you use personal data, done before you start
It’s required where processing is likely to be high risk
AI, monitoring, biometrics, health data and large-scale profiling are the usual triggers
If in doubt, do one, and keep a record of your decision either way
Not sure whether your project needs a DPIA? Privacy Path helps Irish and UK businesses carry out DPIAs that are practical, proportionate and jargon-free. Get in touch at privacypath.ie for a free initial consultation.