AIGovernrAIGovernr
BlogDocs
Sign inSign up
Home/Glossary/Data protection impact assessment (DPIA)

What is Data protection impact assessment (DPIA)?

A data protection impact assessment is a documented analysis of how a planned processing of personal data could affect individuals' rights and freedoms, and how those risks will be reduced. The GDPR requires one where processing is likely to result in a high risk, which can include AI uses.

GDPR Article 35 sets the requirement and lists cases, including systematic and extensive evaluation of individuals based on automated processing and large-scale processing of special category data. Whether a DPIA is mandatory is a question for your data protection officer or legal adviser.

Source: Regulation (EU) 2016/679 (GDPR), EUR-Lex. Last reviewed 3 October 2026. General information, not legal advice.

See also

  • Fundamental rights impact assessment (FRIA)
  • AI risk assessment
  • Automated decision-making (GDPR Art. 22)

Go deeper

  • AI compliance
  • Docs: AI systems

← All AI governance terms

AIGovernrAIGovernr

AI governance software for inventory, governance planning, assurance, evidence, risk, accountable decisions, and continuous monitoring.

AIGovernr is a software product operated by YImagine, Inc.

Product

  • Features
  • How It Works
  • Compliance Scanner
  • Pricing
  • Contact

Guides

  • AI Governance
  • AI Compliance
  • EU AI Act
  • ISO 42001
  • NIST AI RMF
  • AI Governance Platform
  • Glossary

Resources

  • Documentation
  • Getting Started
  • AI Governance Guide
  • Framework Releases
  • For AI Consultants
  • Blog

Trust

  • Trust Center
  • Capability Scope
  • Security
  • Due Diligence

Legal

  • Privacy
  • Terms
  • Refund & Cancellation
  • Cookie Policy
  • Accessibility
© 2026 YImagine, Inc. · Built to keep AI accountable.No certification or compliance guarantee implied.