4 min read · Last updated 3 August 2026
A Data Protection Impact Assessment is a structured review of a processing activity that is likely to result in high risk to the people whose data is involved. It is carried out before the processing begins.
When you need one
- Large-scale processing of sensitive data such as health records.
- Systematic monitoring of a publicly accessible area, including CCTV.
- Automated decision-making with a significant effect on individuals.
- Combining datasets from separate sources in a way people would not expect.
What it contains
- 1A description of the processing and its purpose.
- 2An assessment of necessity and proportionality.
- 3An assessment of the risks to individuals.
- 4The measures you will take to reduce those risks.
Was this article helpful?
If it didn't answer your question, open a ticket and we'll help directly — and improve the article.