DPIA Records

This is the help text the console shows in the help panel on this page.

Data Protection Impact Assessments (DPIAs) for high-risk processing activities. The Scale plan with Risk Management is required to run one. Start an assessment with Run DPIA from a processing activity in the Privacy Register.

When Is a DPIA Required?

A DPIA is mandatory under GDPR Article 35 when processing is likely to result in a high risk to individuals. Common triggers include:

• Large-scale processing of special-category data (Art. 9)
• Systematic monitoring of publicly accessible areas
• Processing involving new technologies
• Automated decision-making with significant effects

Mark such activities as DPIA required in the Privacy Register.

7-Step Wizard

The DPIA wizard walks you through:

1. Necessity & Proportionality — is the processing limited to what is necessary?
2. Risks to Subjects — place each risk on the severity by likelihood matrix.
3. Existing Measures — safeguards already in place.
4. Planned Mitigations — measures to reduce the identified risks.
5. Consultation — who you consulted (DPO, data subjects, regulator).
6. Residual Risk — the risk remaining after mitigations.
7. Decision — Proceed, Proceed with Conditions or Do Not Proceed.

Your progress is saved as you go, and answers are stored encrypted. Finalizing a DPIA cannot be undone.

The List

Records show activity name, status and decision, and can be filtered by status and decision. Open a record to see its details.

Records

Finalized DPIA records cannot be edited. If the processing changes materially, run a new DPIA from the same activity; records linked as superseding or superseded show a badge.

Risk Register Integration

When the decision is Proceed with Conditions or Do Not Proceed, finalizing creates a risk record in the Risk Register (requires Risk Management on your plan). A Proceed decision creates none.