DPIA and when is it typically required?

• A. Data Protection Impact Assessment; required for high-risk data processing activities under GDPR and similar regimes.
• B. Data Processing Agreement; required for all vendor data transfers.
• C. Data Privacy Impact Assessment; required only for large vendors.
• D. Data Processing Authorization; required when onboarding new vendors.

Answer: (A)

A Data Protection Impact Assessment is a structured process to identify and mitigate privacy risks in data processing activities. It’s typically required under GDPR (and similar privacy regimes) when the processing is likely to result in a high risk to individuals’ rights and freedoms. This includes scenarios like large-scale processing, handling of special categories of data, systematic monitoring of people, or the use of new technologies that affect privacy. The DPIA helps you assess necessity and proportionality, identify and implement safeguards, and determine whether the project should proceed or if additional mitigations are needed. If the residual risk remains high after safeguards, you may need to consult the supervisory authority or adjust the plan before proceeding. This topic is about recognizing when a DPIA is needed—not about contractual documents or terms like data processing agreements or vendor size.