data protection impact assessment (DPIA)

advancedwidespread

Mandatory preliminary risk assessment: the organization considers before launch what harm a risky data processing activity could cause people and how to prevent it.

In plain terms

A data protection impact assessment is like a structural survey before construction: you do not check whether the floor slab can bear the load after the residents have moved in. Before launch, the organization documents what personal data it will process, what could go wrong, and what it will do about it.

The EU General Data Protection Regulation (GDPR) requires it when data processing is likely to pose a high risk to the people concerned. Examples include large-scale surveillance of public places, mass processing of health data, or a machine evaluating people and a significant decision about them being made on that basis.

With the spread of AI, this has become even more important. A system screening résumés, an AI agent with access to customer data, or a facial recognition camera are novel technologies where the risk is often high, so an impact assessment is often not optional but mandatory. This must be decided case by case; the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) has also published a list of the mandatory cases.

It does not protect the company, but you. It does not ask what fine the organization might face, but what harm could befall the person whose data is involved.

How it works

Description: the organization records what data it processes, from whom, for what purpose, for how long, and with what tools. In an AI system, this also includes what the model sees and what the agent can access.
Necessity and proportionality: it examines whether the goal can be achieved with less data or a less intrusive method.
Risk assessment: it enumerates what could happen to those affected (for example, data leakage, erroneous or biased machine decisions, discrimination) and how likely and severe this is.
Protective measures: defines how to reduce risk, for example through encryption, access restrictions, human review, or shorter retention periods. It also seeks the opinion of the data protection officer, if one exists.
Decision and follow-up: if the risk remains high after measures, consultation with the data protection authority (in Hungary, the NAIH) is required before launch. The assessment must be updated if the system changes substantially.

An everyday example

Your workplace wants to introduce an AI system that analyzes customer service calls and scores employees' performance. Before it is switched on, the company must describe in an impact assessment what the system monitors, what the scores are used for, and how it will prevent a machine from judging anyone unfairly.

Who is affected

entrepreneur, executiveIf the company launches risky data processing or an AI system working with personal data, it is their responsibility to ensure the impact assessment is completed on time.

developerFor the investigation, you need to find out from them exactly what data flows where, and the findings often rewrite the system's design. → Code

employeeWith workplace monitoring and performance evaluation systems, this is the point where the risks to the employee need to be thought through. → Work & HR

lawyer, citizenIt is one of the most important preventive tools protecting the rights of affected people, which authorities can inspect and hold accountable. → Law

A common misconception

MythThe impact assessment is a one-time form that the lawyer can complete even after implementation.

In realityThe assessment must be carried out before data processing begins, and if the system or risk changes, it must be repeated. Retroactively produced paperwork does not fulfill the obligation.

Limits and risks

The organization examines itself, so quality varies greatly: anything from careful analysis to a ticked-off template can occur.
Impact assessments do not have to be made public, so as an affected party you generally cannot see what they contain.
The completed investigation is not a permit or a guarantee: the system can still cause harm, and the company may still receive a fine.
In AI systems, it is difficult to assess risk in advance because model behavior is not fully predictable, and an agent may access new data during operation.

Similar, but not the same

fundamental rights impact assessment – The EU AI Act requires this of deployers of certain high-risk AI systems, and it covers all fundamental rights, not just personal data protection.
Balancing-of-interests test – This only examines whether the organization's legitimate interest is stronger than the rights of the data subject, meaning it concerns the legal basis, not the full risk picture.
data privacy audit – An audit checks retrospectively whether an already operating data processing activity is compliant, while an impact assessment evaluates the risks in advance, before launch.

Related concepts

Broader

data protection, General Data Protection Regulation, risk management, compliance

Narrower

prior consultation, risk analysis

On the edge

fundamental rights impact assessment, data protection by design, data protection officer, high-risk AI system, automated decision-making

A brief history

The impact assessment grew out of the previous 'privacy impact assessment' practice, which was voluntary in most places, but for example, US federal agencies were required by law to conduct them since the early 2000s. In the EU, it became a general obligation under the General Data Protection Regulation (GDPR) adopted in 2016, with Article 35 to be applied from 25 May 2018.

Where things stand

At the end of 2026, this is an established obligation in the EU, one that the authorities expect organizations to meet. As AI systems and agents spread, more and more organizations have to prepare one. The fundamental rights impact assessment under the AI Act is not yet mandatory because the rules for high-risk systems have been postponed, but organizations are already preparing to align the two.

Status: 2026 November

In the news

Appears in 1 Agent Age stories; the curve shows weekly occurrence in the news magazine.

When a data protection impact assessment is mandatory for an AI systemAug 17, 2026 · Jog

Also known as

data protection impact assessment · DPIA · data protection impact assessment · data protection impact assessment · data protection impact assessment · privacy impact assessment · PIA · GDPR data protection impact assessment

Sources

Privacy impact assessment – Wikipedia

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.