What is a DPIA?
A data protection impact assessment, DPIA, is an analysis of risks to the people concerned required before processing likely to involve high risk begins.
The requirement is in the GDPR. The assessment describes the processing, why it is needed, which risks it brings and how the risks will be handled.
New technology is singled out in the regulation. An AI tool that processes sensitive data or data about many people may therefore need an assessment. The Swedish data protection authority keeps a list of when it is required.
The EU AI Act has its own assessment of the impact on fundamental rights. It applies to certain deployers of high-risk systems, including public bodies.
How it works
The work starts with a description of the processing. Which data, about whom, for what purpose and where it is processed. Then you test whether the processing is necessary and proportionate. After that you assess the risks to data subjects and which measures reduce them. The result is documented.
Before introducing an AI assistant for case officers, you describe which cases it can read, who may ask, where questions are logged and for how long. Risks are assessed on that basis, and measures such as access rights and deletion are written in.
Why it matters
The assessment forces answers to questions that otherwise surface late. Where the data ends up, who can reach it and what happens if something goes wrong. It also provides a record you can show the supervisory authority and the people whose data is processed.
What to keep in mind
A DPIA is a living document. Revisit it when the processing changes, for example when AI is connected to new sources or used for new tasks.
The supplier can help with facts about the service, but the assessment is yours. It has to start from how you use the tool.
What it means for you
Do the assessment before you introduce the tool. Where the data is processed is often the question that affects the result most.
Common questions
When is a DPIA required?
When processing is likely to result in a high risk to the people concerned. Supervisory authorities publish lists of processing where an assessment is always required, and in Sweden that is IMY.
Is one needed for an AI assistant?
It depends on what data it processes and how. New technology, sensitive personal data and large-scale processing all point towards an assessment being needed.
Who carries out the DPIA?
The controller, with advice from the data protection officer if there is one. The supplier should contribute information on how the service works.
What if the risk remains high after mitigation?
Then you must consult the supervisory authority before the processing starts.
Sources: GDPR, Article 35, on EUR-LexImpact assessments and prior consultation at IMY
Related terms
Read more
All terms Updated