Reminder: Data Protection Impact Assessments May Be Required Under New State Privacy Laws

As we settle in to 2025, and five additional state privacy laws have or are about to go into effect, we wanted to put on your radar the obligation to conduct data protection impact assessments (DPIAs). In general, a DPIA should contain:

• a systematic description of potential processing operations and the purpose of the processing, including where applicable, the legitimate interest pursued by the controller;
• an assessment of the necessity and proportionality of the processing operations in relation to the purpose;
• an assessment of the risks to the rights and freedoms of consumers; and
• potential measures to address the risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data.