When should a Data Protection Impact Assessment (DPIA) be conducted?

When should a Data Protection Impact Assessment (DPIA) be conducted?

• A. Only after data incidents occur.
• B. For processing that poses privacy risk but not required by GDPR.
• C. For routine data processing with minimal privacy impact.
• D. For processing that poses high risk to individuals' privacy or when required by GDPR.

Answer: (D)

Conducting a DPIA is about identifying and mitigating privacy risks before processing starts. It should be carried out when the processing is likely to result in a high risk to individuals' rights and freedoms, or when the GDPR requires it under Article 35. This makes it a preventive step aligned with privacy by design, helping you address potential harms early rather than reacting after a breach. It is not appropriate to run a DPIA only after data incidents, or for routine processing with minimal privacy impact, because the risk is too low to justify the extra process. Scenarios that typically trigger a DPIA include large-scale monitoring, processing of sensitive data, or new technologies that could affect privacy. Therefore, undertake a DPIA for high-risk processing or when GDPR requires it.

Conducting a DPIA is about identifying and mitigating privacy risks before processing starts. It should be carried out when the processing is likely to result in a high risk to individuals' rights and freedoms, or when the GDPR requires it under Article 35. This makes it a preventive step aligned with privacy by design, helping you address potential harms early rather than reacting after a breach. It is not appropriate to run a DPIA only after data incidents, or for routine processing with minimal privacy impact, because the risk is too low to justify the extra process. Scenarios that typically trigger a DPIA include large-scale monitoring, processing of sensitive data, or new technologies that could affect privacy. Therefore, undertake a DPIA for high-risk processing or when GDPR requires it.