Also known as: DPIA · privacy impact assessment · PIA
A data protection impact assessment (DPIA) is a structured evaluation of the privacy risks a proposed processing activity poses to individuals, together with the measures planned to mitigate them.
DPIAs are mandatory under GDPR for processing likely to result in high risk, including large-scale profiling, systematic monitoring of public areas, and processing of sensitive categories of data.
Their value depends entirely on timing. Conducted early, a DPIA changes system design — reducing collection, shortening retention, adding controls. Conducted as documentation after the fact, it becomes a compliance artifact that changes nothing.
GDPR
The GDPR (General Data Protection Regulation) is the European Union's data protection law, which governs how personal data of people in the EU may be collected and processed, and grants individuals rights over their data regardless of where the processing organisation is based.
Data Minimization
Data minimisation is the principle that an organisation should collect and retain only the personal data actually necessary for a stated purpose, and no more, for no longer than needed.
Data Subject Rights
Data subject rights are the legal entitlements individuals hold over their personal data, typically including the rights to access, correct, delete, port, and object to the processing of information held about them.
Anonymization
Anonymisation is the process of altering data so that individuals can no longer be identified from it, either directly or by combining it with other available information — as distinct from pseudonymisation, which only replaces identifiers with reversible tokens.