What is a DPIA and when is it required?

• A. A data privacy impact assessment that is optional for all data processing.
• B. A DPIA assesses privacy risks of data processing activities and is required when data use is likely to affect individuals' privacy.
• C. A DPIA is a financial risk assessment for data processing.
• D. A DPIA evaluates cybersecurity threats only.

Answer: (B)

A DPIA is a structured assessment that looks at the privacy risks created by data processing and identifies measures to reduce those risks. It helps you understand what data you’re using, why you’re using it, who has access, how long you’ll keep it, and what safeguards are in place.

It’s required when the data use is likely to affect individuals’ privacy—especially for high-risk processing. This includes activities like processing large volumes of personal data, handling sensitive categories of data, implementing systematic monitoring, or using new technologies that could impact privacy. The goal is to catch potential privacy risks early and choose mitigations before proceeding.

It isn’t a financial risk assessment, nor is it limited to cybersecurity threats. And while some processing may be lower risk or already mitigated by other safeguards, the general rule is that a DPIA is needed when privacy risks are likely to be significant.