What is a Data Protection Impact Assessment (DPIA) and when should a TA conduct one?

• A. Evaluates privacy risks of processing activities
• B. Sets firewall rules
• C. Determines encryption algorithms
• D. Manages user accounts

Answer: (A)

A DPIA is a structured process to identify, assess, and mitigate privacy risks that arise from data processing activities. It helps you map what data is collected, how it’s used, who accesses it, and what the potential impacts on individuals’ privacy could be. A TA should conduct one whenever the processing is likely to result in high risk to people’s rights and freedoms, such as large-scale data processing, systematic monitoring, profiling, automated decision-making, processing of sensitive data, or the use of new technologies. It’s best done during the design phase before processing starts, and updated whenever the processing changes in a way that could increase risk. The DPIA guides what safeguards are needed and documents accountability.

It’s not about firewall rules, encryption choices, or day-to-day user account management—those are security controls that may be informed by the DPIA but aren’t the DPIA itself.