# DPIA Records
URL: https://docs.autociso.io/console/privacy/dpia/
Description: Data Protection Impact Assessments (DPIAs) for high-risk processing activities. The Scale plan with Risk Management is required to run one.

*This is the help text the console shows in the help panel on this page.*

Data Protection Impact Assessments (DPIAs) for high-risk processing activities. [The Scale plan](https://docs.autociso.io/getting-started/plans-and-features/) with [Risk Management is required](https://docs.autociso.io/console/risk/workspace/) to run one. Start an assessment with **Run DPIA** from a processing activity in the [Privacy Register](https://docs.autociso.io/console/privacy/register/).

### When Is a DPIA Required?
A DPIA is mandatory under GDPR Article 35 when processing is likely to result in a high risk to individuals. Common triggers include:
- Large-scale processing of [special-category data](https://docs.autociso.io/console/privacy/data-categories/) (Art. 9)
- Systematic monitoring of publicly accessible areas
- Processing involving new technologies
- Automated decision-making with significant effects

Mark such activities as **DPIA required** in the Privacy Register.

### 7-Step Wizard
The DPIA wizard walks you through:
1. **Necessity & Proportionality** — is the processing limited to what is necessary?
2. **Risks to Subjects** — place each risk on the severity by likelihood matrix.
3. **Existing Measures** — safeguards already in place.
4. **Planned Mitigations** — measures to reduce the identified risks.
5. **Consultation** — who you consulted (DPO, data subjects, regulator).
6. **Residual Risk** — the risk remaining after mitigations.
7. **Decision** — **Proceed**, **Proceed with Conditions** or **Do Not Proceed**.

Your progress is saved as you go, and answers are stored encrypted. Finalizing a DPIA cannot be undone.

### The List
Records show activity name, status and decision, and can be filtered by status and decision. Open a record to see its details.

### Records
Finalized DPIA records cannot be edited. If the processing changes materially, run a new DPIA from the same activity; records linked as superseding or superseded show a badge.

### Risk Register Integration
When the decision is Proceed with Conditions or Do Not Proceed, finalizing creates a [risk record in the Risk Register](https://docs.autociso.io/console/risk/register/) (requires Risk Management on your plan). A Proceed decision creates none.