Data Protection Impact Assessment (DPIA)

A data protection impact assessment is a structured written analysis of what a planned processing activity does to the people whose data it uses, carried out before the activity starts. It describes the processing, tests whether it is necessary and proportionate to the purpose, identifies the risks to individuals, and records the measures that reduce them. Under the GDPR it is required where processing is likely to result in a high risk to people's rights and freedoms. AI features raise the questions a DPIA is designed to ask more often than conventional software does. Personal data may reach a third-party model provider. Retention becomes uncertain when prompts and outputs are logged for debugging. Outputs can be wrong about a specific person in ways that are hard to detect and hard for them to contest. Where a system profiles people or contributes to decisions about them, the analysis is not optional paperwork. The assessment has a recognisable shape. Describe the processing and its purpose in concrete terms. Establish the lawful basis and whether the same purpose could be met with less data or with data that no longer identifies anyone. Map where the data goes, including subprocessors and the countries involved. State the risks from the perspective of the individual rather than of the company, then list the mitigations and be honest about which risks remain after them. The most common weakness is a DPIA written after the launch date is fixed. At that point it becomes a justification exercise, because the answers that would change the design — collect less, keep it shorter, keep it in one region, do not send it to a third party at all — are no longer affordable. Done early it is a design tool; done late it is a document. Revisit it when the processing changes materially, and keep it with the AI system's inventory entry rather than in a legal folder nobody browses. A change of model provider, a new retention setting, or a feature that starts making a decision instead of suggesting one all change the analysis, and the record is only useful if a reader can tell which version of the system it describes.