Data governance - Document
DPIA
(Data Protection Impact Assessment)
A formal assessment of privacy risks before carrying out higher-risk use of personal information
What's it for?
Checks how a proposed use of personal information could affect people before the work goes ahead.
For example…
Before rolling out workplace CCTV with facial recognition, the organisation completes a DPIA and documents mitigations
Before introducing facial recognition for building access, the organisation completes a DPIA to assess privacy harms, alternatives and safeguards.
Think of it like…
Risk assessment before a school trip: you map what could go wrong for people and decide controls before you leave