It describes the processing, assesses necessity and proportionality, identifies risks to the people affected and sets out the measures that address them. Where high risk remains, the controller has to consult the supervisory authority first.
The DPIA guide covers when one is needed.
Read more
Related terms
- GDPR
- The GDPR is the EU General Data Protection Regulation, which governs how personal data of people in the EU is processed and protected.
- Record of processing activities
- A record of processing activities is the GDPR Article 30 record of what personal data is processed, why, about whom, where it goes and for how long.