Data Protection Impact Assessment

A DPIA is a written record showing you thought about the privacy impact of a new project before launching it. This wizard walks you through the eight risk factors most regulators look for. Your answers stay in your browser tab — nothing is saved.

Project / processing activity name

Brief description of the processing

Lawful basis

Elevated-risk factors

Check any that apply. The more you check, the higher the risk band.

Special-category data is processed
Health, biometric, racial, religious, sexual-orientation, genetic, or trade-union data is treated as sensitive and requires elevated safeguards under most privacy laws. Subjects include children or other vulnerable groups
Children, asylum seekers, patients, employees in unequal power relationships, or other vulnerable groups need additional protection. Decisions are made or assisted by automated means
Automated decisions with legal or similarly significant effects (e.g., credit, insurance, hiring) require explicit safeguards and the right to human review. Processing happens at large scale
Large numbers of subjects, large volume of data per subject, wide geographic spread, or long-running processing all increase the impact of any incident. Systematic monitoring of a publicly accessible area
CCTV, location tracking, public-Wi-Fi capture, web tracking across sites — all involve people who did not actively choose to be observed. Data leaves the country of the data subjects
Cross-border transfers require an appropriate safeguard (adequacy decision, standard contractual clauses, binding corporate rules) and a documented assessment of the destination country. Novel or invasive technology is used
Biometrics, facial recognition, behavioural profiling, IoT, large-language-model integrations — anything where the privacy implications are not yet well understood. Subjects cannot easily refuse or withdraw
Where consent is the lawful basis but refusing has practical consequences (e.g., losing access to a service), the consent may not be freely given.