DPIA (Data Protection Impact Assessment)
The GDPR-mandated analysis before any processing of personal data likely to pose a high risk to individuals, such as many uses of AI.
A Data Protection Impact Assessment (DPIA) is mandatory under Article 35 GDPR when processing personal data is likely to result in a high risk to people's rights: for example, automated evaluations or profiling with significant effects, large-scale processing of sensitive data or systematic monitoring. Using new technologies, such as AI, is one of the criteria that make it necessary.
It must describe the processing and its purpose, assess whether it is necessary and proportionate, analyse the risks to individuals and set measures to reduce them. If the risk remains high after those measures, the data protection authority must be consulted.
When AI processes personal data, a DPIA is usually essential and complements the AI Act's fundamental rights impact assessment.
Reference: Art. 35 RGPD
Related terms
Take the free assessment and find out in a few minutes which obligations your company has and where to start.
← Back to the glossaryUpdated: October 2026 · Informational content, not legal advice.