# What is a DPIA?

> A DPIA, or data protection impact assessment, is a written GDPR check of privacy risk before high-risk personal-data processing begins.

Source: https://meshin.co/glossary/dpia
Updated: 2026-10-07

---

## Why it comes up

Almost any AI system worth building processes personal data, which makes a DPIA the default question rather than an edge case. Legal or procurement asks for it specifically once a system moves from a prototype to something touching real customer records. People often confuse it with the newer AI Act impact assessment. That is why explaining the difference is usually the more useful answer than either document alone.

## When monitoring staff triggers one

Article 35(3) names three cases, but Article 35(1) asks for a DPIA wherever processing is likely to result in a high risk to people.

The Article 29 Working Party's 2017 guidelines list criteria that point to high risk. Systematic monitoring is one. Data about vulnerable people is another, and employees may count as vulnerable because of the power imbalance. Meeting two criteria means a DPIA in most cases.

Whether a dashboard of AI tool usage counts as systematic monitoring depends on how person-level it is. That is an inference, not a regulator's ruling.

## What to do about it

Write the DPIA before the system is built, not after, since a risk found during design is cheap to change. The same risk found after launch usually is not. Start from what the system actually collects and why, not from a template's headings. Consult the data protection officer while there is time to act. The [AI Governance Starter Kit](/resources/ai-governance-starter-kit) lays out the same data classification a DPIA starts from.