The Data Protection Impact Assessment (DPIA)

Introduction.

The GDPR under Article 35 introduces the concept of a Data Protection Impact Assessment ("DPIA").

DPIA is a process designed to describe the processing, assess its necessity and proportionality and help manage the risks to the rights and freedoms of natural persons resulting from the processing of personal data by assessing them and determining the measures to address them. DPIAs are important tools for accountability, as they help controllers not only to comply with requirements of the GDPR, but also to demonstrate that appropriate measures have been taken to ensure compliance with the Regulation

In other words, a DPIA is a process for building and demonstrating compliance.