Glossary · D
Data protection impact assessment
A data protection impact assessment is a structured analysis, performed before a new or changed use of personal data goes live, of the risks to the individuals concerned and the measures that reduce them.
Extended definition
In more detail.
The assessment describes the processing, tests its necessity and proportionality, identifies risks to individuals, specifies measures, records consultation and ends with a residual-risk decision by an accountable owner. GDPR requires one for processing likely to result in high risk; other laws and customer contracts increasingly expect it. Where AI processes personal data, it overlaps with an AI impact assessment and the two are usually combined.
In our work
Where it appears.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days