Governance · Privacy and data governance · 04
Data protection impact assessments
A data protection impact assessment examines a new or changed system, process or use of personal data before it goes live, to identify the risks to the individuals concerned and the measures that reduce them, and to record the decision. It is needed when GDPR or a similar law requires an assessment for high-risk processing, when a new system will handle sensitive data, when AI or profiling will be applied to personal data, when a customer requires an assessment before sharing data, or when a change to an existing process alters its risk. The assessment produces a structured analysis of purpose, necessity, data, risks and measures, consultation records where required, the residual risk accepted by an accountable owner, and the documentation a regulator would examine.
Scope
What the review covers.
- Description of the processing: purpose, data, flows, recipients, retention
- Necessity and proportionality against the purpose
- Risks to individuals and their likelihood and severity
- Measures to reduce risk: technical, organizational, contractual
- Consultation with stakeholders and, where required, the regulator
- Residual risk acceptance, sign-off and review triggers
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Impact assessment | Structured, complete, signed |
| Measures register | Risk reductions with owners |
| Consultation record | Who was consulted and what changed |
| Review schedule | When the assessment is revisited |
Prerequisites
What we need from you.
- Design documentation for the system or process being assessed
- Access to the owners, the data and the vendors involved
- The legal determination of whether an assessment is required, with counsel
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
When is an assessment required?
When processing is likely to result in high risk to individuals. The regulations and regulators publish criteria; counsel confirms. When in doubt, performing one is rarely wrong.
Can this be combined with an AI impact assessment?
Yes, where AI processes personal data. The two assessments share most of their structure. See Impact assessment for high-consequence uses.
Who signs?
An accountable owner authorized to accept residual risk, with the data protection officer or equivalent where one exists.