Comparing The Data Protection Assessment Requirements Across The Next Generation Of U.S. State Privacy Laws

What is a data protection impact assessment (DPIA)?

A data protection impact assessment or data protection assessment (DPIA) is a form of risk assessment that is designed to help organizations identify, analyze and minimize the privacy risks associated with their data collection, use, retention, and disclosure practices.

The DPIA is a familiar concept for those versed in the General Data Protection Regulation (GDPR), which mandates DPIAs for any "high risk" processing as a part of the "privacy by design" principle.

Historically, consumer privacy laws in the United States did not mandate the performance of DPIAs, but that is about to change.