Data protection impact assessment (DPIA)

Last reviewed on 4 April 2022
School types: All · School phases: All
Ref: 34261

Find out what a data protection impact assessment (DPIA) is, when it must be done, and who should be involved. Download and adapt our DPIA template to save you time.

Article tools

Contents

  1. What is a data protection impact assessment?
  2. When to conduct one
  3. How to carry out a DPIA
  4. Download our template
  5. Who else needs to be involved

What is a data protection impact assessment?

A data protection impact assessment (DPIA) is a process that helps you:

  • Thoroughly analyse your data processing
  • Identify and minimise data protection risks
  • Comply with accountability obligations under the UK GDPR 
  • Assess and demonstrate how you comply with all of your data protection obligations

Read more in the guidance from the Information Commissioner’s Office (ICO):

Even if you outsource your DPIA, for example to a relevant data processor, you remain responsible for it.

The ICO recommends that you provide staff training on DPIAs. Not every staff member will need to know about them, but make sure that anyone responsible for making decisions on data processing knows when to conduct a DPIA and how to do it.

When to conduct one

To assess whether something is likely

Read next

Also in 'Data protection and sharing information'