What is a DPIA?
A Data Protection Impact Assessment (DPIA) is a structured process to identify and minimise data protection risks of a project, system or processing activity — mandated by GDPR Article 35 when processing is “likely to result in a high risk to the rights and freedoms of natural persons”. KVKK Article 12 imposes parallel obligations on Turkish data controllers, with additional implementation guidance from VERBİS Tebliği and Kurul kararları.
When a DPIA is required
- Systematic and extensive evaluation based on automated processing, including profiling.
- Large-scale processing of special-category data (health, biometrics, race, religion, political opinion).
- Systematic monitoring of publicly accessible areas on a large scale.
- New technologies with significant risk implications (AI systems, biometric ID, IoT).
- EDPB list: EDPB and member-state DPAs publish lists of processing requiring DPIA.
Required DPIA content (GDPR Article 35(7))
- Description of processing operations and purposes.
- Assessment of necessity and proportionality.
- Assessment of risks to data subjects.
- Measures to address risks (safeguards, security, mechanisms).
DPIA vs. related assessments
- DPIA vs. FRIA (AI Act): DPIA is data protection focused; FRIA is broader fundamental rights focused; both may apply.
- DPIA vs. TIA: Transfer Impact Assessment specifically for international transfers post-Schrems II.
- DPIA vs. privacy risk assessment: DPIA is the GDPR-defined formal version.
When a DPIA is required and how it is used
A Data Protection Impact Assessment is expected before processing that is likely to create a high risk to individuals — for example large-scale profiling, systematic monitoring of publicly accessible areas, processing of special-category data at scale, or the deployment of a new technology whose effects are not yet understood. The assessment documents the processing operation, tests its necessity and proportionality against the purpose, identifies the risks to data subjects, and records the measures chosen to reduce those risks. Where a high residual risk remains even after mitigation, prior consultation with the supervisory authority may be required before processing starts. A DPIA is not a one-off form: it is a living document that should be revisited whenever the purpose, scope, technology or risk profile of the processing changes.