DPIA
CIPP/E glossary · Last reviewed: · By Victor Humenhuk (CIPP/E certified)
DPIA - Data protection impact assessment - a systematic process to identify and minimise the data protection risks of processing; mandatory for likely-high-risk processing.
In the CIPP/E body of knowledge, DPIA comes up under Ch 11.5 - Article 35 & 36; Ch 14.6.4 - Necessity; Ch 4.4 - Controller and processor.
DPIA in context
- A [[DPIA]] (also called a [[PIA]]) systematically identifies and addresses the data protection impacts of new products, services or activities. (Data protection impact assessment (DPIA))
- A [[DPIA]] is required where monitoring is likely to result in a ==high risk== to individuals' rights and freedoms - in particular where it is a systematic and extensive evaluation based on [[automated processing]] producing legal or similarly significant effects. (Necessity and the DPIA)
- A compliant scheme needs a [[DPIA]], works-council liaison, transfer mechanisms ([[SCCs]]/[[BCRs]]), and a careful policy following [[WP29]]/[[CNIL]] guidance. (Whistleblowing schemes)
Where DPIA is covered in the CIPP/E study notes
- Controller vs Processor - Roles and Liability
- Data protection impact assessment (DPIA)
- Necessity and the DPIA
- Module 8 · CCTV / video surveillance & Guidelines 3/2019
- Module 10 · Accountability defined (Article 24)
- Module 10 · Data protection impact assessment (DPIA, Articles 35 and 36)
Related terms
- controller
- processor
- PIA
- Article 35
- Article 36
- Automated processing
- WP29
- CCTV
- Prior checking
- EDPB Guidelines 3/2019
Test yourself on DPIA
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/E practice questions, or read the full CIPP/E study guide - every study note is free.